News

Outlook-Word Vulnerability Could Allow Code Execution

Organizations running Microsoft's Outlook e-mail client face a new security vulnerability if some users choose Word as their default e-mail editor.

Microsoft classifies the newly discovered vulnerability as a moderate risk to client systems, and the company has a patch available at www.microsoft.com/technet/security/bulletin/MS02-021.asp.

A feature of Outlook 2000 and Outlook 2002 allows users to select Microsoft Word as the e-mail editor when writing or editing e-mail in Rich Text or HTML. A vulnerability means that when Outlook is used that way, replying or forwarding to e-mail from a malicious user could execute scripts that run in the security context of the user.

Microsoft uses different security settings for displaying e-mail versus editing e-mail. Outlook displays HTML e-mail by applying Internet Explorer security zone settings that prevent scripts from running. But if the user replies or forwards the message, Outlook opens the e-mail and passes the message to the Word editor, which doesn't block scripts.

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.

Featured

  • Microsoft Releases Windows 10 Version 1909

    Microsoft on Tuesday announced the release of Windows 10 version 1909, a new operating system product that's also known as the "Windows 10 November 2019 Update."

  • November Microsoft Security Bundle Addresses 75 Vulnerabilities

    Of that number, 13 vulnerabilities are rated "Critical" to patch, while 62 vulnerabilities are deemed "Important."

  • The Future of Office 365 Pricing

    With a raft of new Office 365 features in the pipeline, Microsoft also seems ready to change the way it bills its subscribers. Will it replicate Azure's pay-per-use model, or will it look like something else entirely?

  • Microsoft Offers 1 Year of Free Windows 7 Extended Security Updates to E5 Licensees

    Microsoft is offering one year of free support under its Extended Security Updates program to Windows 7 users if their organizations have E5 licensing.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.