News

New Outlook Virus Could be Deadliest Yet

Microsoft Corp. has released a patch to eliminate a security vulnerability in Outlook and Outlook Express. Under certain conditions, the vulnerability could allow a hacker to cause code of his choice to execute on another user's computer.

A component shared by Outlook and Outlook Express contains an unchecked buffer in the functionality that parses e-mail headers when downloading mail via either POP3 or IMAP4. By sending an e-mail that overruns the buffer, a malicious user could cause either of two effects to occur when the mail is downloaded from the server by an affected e-mail client. If the affected field were filled with random data, the e-mail could be made to crash. If the affected field were filled with carefully crafted data, the e-mail client could be used to run code of the hacker's choice.

Effectively, the security hole would grant a hacker complete remote control of a computer through the placement of executable code.

Users who have installed Internet Explorer 5.01 Service Pack 1, or who have installed Internet Explorer on a system other than Windows 2000, are not affected. Additionally, Outlook users who have configured Outlook to use only MAPI services would not be affected. Outlook Express 4.0, 4.01, 5.0, and 5.01, as well as Outlook 97, 98, and 2000 are all affected.

The vulnerability can be eliminated by installing either IE 5.01 Service Pack 1 or IE 5.5, on any system other than Windows 2000. - Isaac Slepner

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.

Featured

  • Spaceflight Training in the Middle of a Pandemic

    Surprisingly, the worldwide COVID-19 lockdown has hardly slowed down the space training process for Brien. In fact, it has accelerated it.

  • Surface and ARM: Why Microsoft Shouldn't Follow Apple's Lead and Dump Intel

    Microsoft's current Surface flagship, the Surface Pro X, already runs on ARM. But as the ill-fated Surface RT showed, going all-in on ARM never did Microsoft many favors.

  • IT Security Isn't Supposed To Be Easy

    Joey explains why it's worth it to endure a little inconvenience for the long-term benefits of a password manager and multifactor authentication.

  • Microsoft Makes It Easier To Self-Provision PCs via Windows Autopilot When VPNs Are Used

    Microsoft announced this week that the Windows Autopilot service used with Microsoft Intune now supports enrolling devices, even in cases where virtual private networks (VPNs) might get in the way.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.