Quantcast
Subscribe to magazine

Microsoft Patches Outlook Security Hole

Flaw in e-mail editing feature could allow malicious script to be run on a PC.

Sam Costello, IDG News Service

  • 0 Yes
  • 0 No

A security vulnerability that could affect users of Microsoft's Outlook 2000 and 2002 e-mail clients who use the company's Word application as an e-mail editor has been patched, according to an advisory from Microsoft.

The vulnerability results from different security settings in the two applications used when an e-mail is being read and when it is being written, Microsoft says.

When an e-mail is displayed in Outlook, the program uses the security settings of Internet Explorer, often configured to disallow the execution of scripts. But when the e-mail is replied to or forwarded using Microsoft Word as the application to write the e-mail, Word's security settings are used, which allow scripts to be run, the company says.

Possible Problems

If an attacker were to send an HTML e-mail containing a script to a user who had their PC configured this way, then any code of the attacker's choice could be run on the target PC if the user replied to or forwarded the e-mail, says Microsoft, based in Redmond, Washington.

Users who have applied Office XP Service Pack 1 are protected against this hole, the company says.

This issue was also the subject of a recent vulnerability announcement by independent security researcher Georgi Guninski.

More information about the flaw and the patch to fix it are available on Microsoft's Web site.

  • Recommend this story?
  • 0 Yes
    0 No
 

Featured APC Accessories

  • APC Back-UPS ES Safeguards your equipment from damaging surges and spikes that travel along your utility & data lines.
  • APC SurgeArrest Performance Highest level of protection for your professional computers, electronics and connected devices, as well as provides surge protection.

People who read this also read:

  • 15 Minutes to a Secure Business Get the Secure in 15 toolkit starting with the "15 Minutes Month-at-a-Glance" calendar. McAfee will send you additional tools and tricks to stay protected around the clock.
  • A Buyer's Guide to Data Protection Implementing data protection products and processes can be daunting. Make the right decisions by exploring what is available and what makes sense for your organization. Use this simple guide to evaluate different vendor offerings.

Sponsored Links