[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Full-disclosure] Recall: Oracle read-only user can insert/update/delete data



In my experience, it doesn't even work in an Exchange environment. The
user gets a message that the message should be recalled, but the
original is still there, even if it hasn't been read yet. I've heard
people say that at one time it would auto-delete the message if it
hadn't been read, but I've never seen that.

It does, provided you read the "recall" message first -- but since Outlook (by default) displays in reverse chronological order, and most people read email in the order received, it does little good.

Back when I was involved in Exchange administration, I can't tell you how many times I had to stop services and run exmerge against the store to clean out messages that somebody accidently sent to a distribution list.

That .. and all the people that got embarassed due to incorrect use of "reply-all" ;)

~Mike.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/