Microsoft Warns of Critical Flaw in Outlook Express
The company has issued a patch for the problem, which affects Outlook Express 5.5 and 6.0. Machines running Outlook are not affected.
The problem lies in the way that Outlook Express generates a warning message when a specific error condition occurs. There is a buffer overrun vulnerability in the code that generates the warning message, which is associated with messages that are signed with S/MIME (secure multipurpose Internet mail extensions).
An attacker could exploit this flaw by creating a digitally signed message, inserting some specific data that would cause the error condition and then sending the message to another user. If the recipient opened or previewed the message, the Outlook Express client would either crash or allow the attacker to run whatever code he chose on the users machine.
The code would run with the permission level of the local user.
The patch for this flaw is available here.
Outlook Express is used mainly by home users and some small businesses.