Outlook is unilaterally blocking attachments

[Red Squirrel]

Someone in my workplace is sending .url files and outlook keeps blocking them. They're just shortcuts. :hmm:

I can't seem to find a way to unblock this, anyone know how? I'm hoping it can be done at the server (Exchange 2003) level.

 

[yinan]

It can be done at the server level, but I REALLY wouldnt do it. It is a HUGE security vulnerability. There is a hidden public folder that you have to connect with by starting Outlook in admin mode.

 

[Red Squirrel]

How is it a security issue though? It's not any different then someone just sending a link directly. Or is outlook stupid and does it actually try to load the web page directly in the email?

 

[stash]

Files with a .url extension are executable, which is why Outlook blocks them. It would be simple to send someone a virus with a .url extension and have them be owned when they open it.

 

[Red Squirrel]

Oh right, kinda like .pif and .lnk ? Guess that would make sense then. I forget how but I remember seeing a .lnk file actually execute itself, rather then just a target.

I'll just have to explain to users to put the link in the email instead of sending the .url files.

 

[stash]

Yep, should be a quick user education fix. Here's the list of attachments that are blocked.
http://office.microsoft.com/en-us/outlook/HA012299521033.aspx