Patching Another Outlook Security Hole

Microsoft has identified another security hole in its Outlook e-mail software and says a fix is available for the glitch.

The software maker last week released a patch for its Outlook and Outlook Express clients, following the identification of a hole in the software that could allow hackers to use a vCard to disable Outlook, or run code through the program.

The vCard attachment is a common way to share address book information.

This exploit, like many viruses, will work only if the user opens an infected attachment in an e-mail document. It was reported to Microsoft by Ollie Whitehouse, a British programmer.

The patch is available from Microsoft, and, as always, the company urges users to follow sound security measures, which include not opening unexpected attachments, especially from strangers.

As evidenced by the spread of the Kournikova virus earlier this month, however, users are still all too willing to open suspect attachments.

According to the Microsoft security advisory, "Outlook Express provides several components that are used both by it and, if installed on the machine, Outlook. One such component, used to process vCards, contains an unchecked buffer."

A buffer temporarily stores data in devices or software. Programmers can design buffers to check the size of data entered into them and reject entries that are too long. When they are "unchecked," it means there is no such safeguard, and users can enter any amount of data. In the case of Outlook, the unchecked buffer would allow a malicious user to create a vCard that contains what Microsoft called "specially malformed data." When a recipient opened such a vCard, the data overflow the available buffer size and crash the e-mail software.

"In a more serious case, a malicious user could exploit the unchecked buffer to run unauthorized code on the other user's computer," Microsoft warned.

Sara Radicati, president and chief executive of The Radicati Group in Palo Alto, California, says she hasn't heard of this hole being a problem yet.

"This is such a low-level issue . . . it just might not have bubbled up yet," she says.