News

Outlook-Word Vulnerability Could Allow Code Execution

Organizations running Microsoft's Outlook e-mail client face a new security vulnerability if some users choose Word as their default e-mail editor.

Microsoft classifies the newly discovered vulnerability as a moderate risk to client systems, and the company has a patch available at www.microsoft.com/technet/security/bulletin/MS02-021.asp.

A feature of Outlook 2000 and Outlook 2002 allows users to select Microsoft Word as the e-mail editor when writing or editing e-mail in Rich Text or HTML. A vulnerability means that when Outlook is used that way, replying or forwarding to e-mail from a malicious user could execute scripts that run in the security context of the user.

Microsoft uses different security settings for displaying e-mail versus editing e-mail. Outlook displays HTML e-mail by applying Internet Explorer security zone settings that prevent scripts from running. But if the user replies or forwards the message, Outlook opens the e-mail and passes the message to the Word editor, which doesn't block scripts.

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.

Featured

  • Cloud Services Use on the Rise But Security Concerns Remain

    A recently published industry report suggested that use of public cloud services by organizations may nearly double in the next two years.

  • OneDrive Users To Get Storage Options, Plus New Personal Vault

    Microsoft announced a few OneDrive enhancements, including storage-option additions, plus a new "Personal Vault" feature for added security assurance.

  • Cloud Services Starting To Overtake On-Prem Database Management Systems

    Database management system (DBMS) growth is happening more on the cloud services side than on the traditional "on-premises" side, according to a report by Gartner Inc.

  • How To Replace an Aging Domain Controller

    If the hardware behind your domain controllers has become outdated, here's a step-by-step guide to performing a hardware refresh.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.