|
Posted by karl levinson, mvp on October 20, 2006, 11:06 pm
Please log in for more thread options That's wrong. You could escalate and demand a manager. I could be
mistaken, but it seems to me they should want to see if they can replicate
the security problem.
If you send it to secure@microsoft.com, they will never charge you.
> Hello,
>
> thank you for your reply. I send the case to the email address today.
>
> Actually I informed our Microsoft technical account manager about this
> weakness. In return the technical support clerk send me a bill
> (forecast) for 6 hours engineering and I wasn't willing to pay for it.
> So they closed the case. That was really a bit disapointing.
>
> - Jiriki
>
>
> karl levinson, mvp schrieb:
>
>> > Hello,
>> >
>> > as I wrote in
>> >
http://groups.google.de/group/microsoft.public.windows.server.security/browse_frm/thread/094ebf41821513d9/791e05d4b9ac236b?tvc=1&
>> >
>> > documents do no stay encrypted if you copy the file to a WebDAV folder
>> > that is connected using a ssl connection (https). Everything works fine
>> > as long as you use http only. ("files may be encrypted locally on the
>> > client and then transmitted as a raw encrypted file to the WebDAV
>> > server" see:
>> >
"http://www.microsoft.com/technet/prodtechnol/winxppro/support/dataprot.mspx")
>> >
>> > Today I learned that this is not a problem of the Internet Explorer
>> > alone, it also happens if you use the Windows Explorer to connect to
>> > the WebDAV folder. So I assume it is a weakness of the underlying
>> > WebClient service.
>> >
>> > Microsoft claims "EFS with WebDAV folders provides simple and secure
>> > ways for individual and corporate users to share sensitive data across
>> > insecure networks."
>> >
>> > I'm not quite sure about that any more.
>>
>> You might email this issue to secure@microsoft.com. If it is a security
>> flaw, they will research it for free, tell you and fix it.
>>
>> --
>> kind regards,
>> Karl Levinson, CISSP, CCSA, MCSE [MS MVP]
>> --------------------------------
>> Microsoft Security FAQ:
>> http://securityadmin.info
>
| 
XML Sitemap