Vulnerability Development: Microsoft Office XP and Outlook in HTML Format

[Clinton Smith <festive () iinet net au>]

I have seen some unusual behaviour whilst debugging a problem
with Microsoft Office XP / Outlook on a standard install under win 98SE

If you create a blank HTML format for your messages, some very unusual
XML/HTML
is being sent along with it...

Is there anyone researching this yet? If so I would like to know if
there is any relationship
between the "cid" listed in the resulting email (read on a NON-M$ mail
client, or as I did
directly out of a UNIX mail queue) and the Product ID or other personal
data.

The primary question is: Does the inclusion of all of this strange
content compromise privacy?

The next logical progression for this is to determine whether, even
after sending a HTML-BASED
email message through an anoymous remailer, it still includes this
information, and whether this in itself
is proof of authorship.

Clinton