Quantcast
PCWorld.com is upgrading some back-end systems. Some site features, such as user registration, may be temporarily unavailable.

Security Hole Found in MSN Messenger

Critical flaw in Microsoft's chat and IM tools could allow attacker to run code on vulnerable PCs.

Sam Costello, IDG News Service

  • 0 Yes
  • 0 No

A security hole deemed "critical" by Microsoft could allow an attacker to run code of their choice on a vulnerable PC by exploiting a problem in Microsoft's MSN Chat, MSN Messenger, and Exchange Instant Messenger products, Microsoft says in a security alert Wednesday. The company has patched the vulnerability.

The vulnerability comes in an ActiveX control that allows users of MSN Chat, Messenger, and Exchange Instant Messenger to group together in a single "space" to chat in real time, Microsoft says.

A buffer overflow in the component could allow an attacker to assault the flaw and run any code against vulnerable machines, Microsoft says. An attacker could also exploit the vulnerability using a malicious Web site or through e-mail formatted in HTML, the Redmond, Washington, company says.

The ActiveX component that allows the chat feature is included with MSN Messenger 4.5 and higher and Exchange Instant Messenger, Microsoft says. MSN Chat users and Windows XP users, however, would only be vulnerable to the bug if they had downloaded and installed the chat component separately, Microsoft says.

E-Mail Protection

E-mail users are protected if they have downloaded the Outlook E-Mail Security Update or are running Outlook 2002 or Outlook Express, the company says.

More information about the vulnerability, and a patch to repair it, are available on Microsoft's Web site.

Microsoft's chat problem comes three days after the announcement of a security hole in rival America Online's Instant Messenger application that could have allowed attackers to run programs of their choice. That flaw has since been patched by AOL.

  • Recommend this story?
  • 0 Yes
    0 No
  • Great year-end deals
    for small business!
  • Get 24/7 live remote AT&T Tech Support 360* service along with select Lenovo* PCs (with Intel® Core™ 2 Duo processors) and save up to 200!

    Learn more

  • HP EliteBook* 6930p Notebook with Intel® vPro™ technology and a free HP Basic Docking Station - $641 instant savings!

    Learn more

People who read this also read:

Sponsored Links