News

New Outlook Virus Could be Deadliest Yet

Microsoft Corp. has released a patch to eliminate a security vulnerability in Outlook and Outlook Express. Under certain conditions, the vulnerability could allow a hacker to cause code of his choice to execute on another user's computer.

A component shared by Outlook and Outlook Express contains an unchecked buffer in the functionality that parses e-mail headers when downloading mail via either POP3 or IMAP4. By sending an e-mail that overruns the buffer, a malicious user could cause either of two effects to occur when the mail is downloaded from the server by an affected e-mail client. If the affected field were filled with random data, the e-mail could be made to crash. If the affected field were filled with carefully crafted data, the e-mail client could be used to run code of the hacker's choice.

Effectively, the security hole would grant a hacker complete remote control of a computer through the placement of executable code.

Users who have installed Internet Explorer 5.01 Service Pack 1, or who have installed Internet Explorer on a system other than Windows 2000, are not affected. Additionally, Outlook users who have configured Outlook to use only MAPI services would not be affected. Outlook Express 4.0, 4.01, 5.0, and 5.01, as well as Outlook 97, 98, and 2000 are all affected.

The vulnerability can be eliminated by installing either IE 5.01 Service Pack 1 or IE 5.5, on any system other than Windows 2000. - Isaac Slepner

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.

Featured

  • Jumbled Word Cloud Graphic

    Q&A: How Microsoft Is Raising Azure Arc's Data Services Game

    Ignite 2020 saw the public preview of Azure Arc enabled data services, the latest step in Microsoft's bid to demystify multicloud. Principal program manager Travis Wright explains how it works.

  • Ivanti Buys MobileIron and Pulse Secure

    The acquisitions are expected to enhance Ivanti's mobile endpoint security offerings.

  • Microsoft Touts Azure as 'Carrier-Grade Platform' for Telcos Deploying 5G

    Microsoft has affirmed its software-defined networking infrastructure support for telecom companies, especially as they move more toward rolling out 5G wireless services.

  • Microsoft Rebrands Enterprise Security Solutions as 'Microsoft Defender'

    Microsoft took the occasion of its Ignite event last week to rebrand its enterprise security solutions for premises and cloud environments, mostly by putting "Microsoft Defender" on their names.

comments powered by Disqus