News
New Outlook Virus Could be Deadliest Yet
- By Scott Bekker
- July 19, 2000
Microsoft Corp. has released a patch to eliminate a security vulnerability in Outlook and Outlook Express. Under certain conditions, the vulnerability could allow a hacker to cause code of his choice to execute on another user's computer.
A component shared by Outlook and Outlook Express contains an unchecked buffer in the functionality that parses e-mail headers when downloading mail via either POP3 or IMAP4. By sending an e-mail that overruns the buffer, a malicious user could cause either of two effects to occur when the mail is downloaded from the server by an affected e-mail client. If the affected field were filled with random data, the e-mail could be made to crash. If the affected field were filled with carefully crafted data, the e-mail client could be used to run code of the hacker's choice.
Effectively, the security hole would grant a hacker complete remote control of a computer through the placement of executable code.
Users who have installed Internet Explorer 5.01 Service Pack 1, or who have installed Internet Explorer on a system other than Windows 2000, are not affected. Additionally, Outlook users who have configured Outlook to use only MAPI services would not be affected. Outlook Express 4.0, 4.01, 5.0, and 5.01, as well as Outlook 97, 98, and 2000 are all affected.
The vulnerability can be eliminated by installing either IE 5.01 Service Pack 1 or IE 5.5, on any system other than Windows 2000. - Isaac Slepner
About the Author
Scott Bekker is editor in chief of Redmond Channel Partner magazine.