RSS
Subscribe to magazine
Follow us on:
  • Recommend:
  • 0 Comments

Microsoft Patches Outlook Security Hole

Flaw in e-mail editing feature could allow malicious script to be run on a PC.

By Sam Costello, IDG News   

A security vulnerability that could affect users of Microsoft's Outlook 2000 and 2002 e-mail clients who use the company's Word application as an e-mail editor has been patched, according to an advisory from Microsoft.

The vulnerability results from different security settings in the two applications used when an e-mail is being read and when it is being written, Microsoft says.

When an e-mail is displayed in Outlook, the program uses the security settings of Internet Explorer, often configured to disallow the execution of scripts. But when the e-mail is replied to or forwarded using Microsoft Word as the application to write the e-mail, Word's security settings are used, which allow scripts to be run, the company says.

Possible Problems

If an attacker were to send an HTML e-mail containing a script to a user who had their PC configured this way, then any code of the attacker's choice could be run on the target PC if the user replied to or forwarded the e-mail, says Microsoft, based in Redmond, Washington.

Users who have applied Office XP Service Pack 1 are protected against this hole, the company says.

This issue was also the subject of a recent vulnerability announcement by independent security researcher Georgi Guninski.

More information about the flaw and the patch to fix it are available on Microsoft's Web site.

Would you recommend this story? YES NO

  • Recommend:
  • 0 Comments

Subscribe to the Laptop Link Newsletter - weekly

See All Newsletters »
Lenovo Laptop Deals

Subscribe to the Laptop Link Newsletter - weekly

See All Newsletters »
Today's Special Offers
Editors' Picks