Microsoft Corp. on Thursday warned of a critical new flaw in its Outlook Express e-mail client that gives attackers the power to run any code they choose on a vulnerable machine.
The company has issued a patch for the problem, which affects Outlook Express 5.5 and 6.0. Machines running Outlook are not affected.
The problem lies in the way that Outlook Express generates a warning message when a specific error condition occurs. There is a buffer overrun vulnerability in the code that generates the warning message, which is associated with messages that are signed with S/MIME (secure multipurpose Internet mail extensions).
An attacker could exploit this flaw by creating a digitally signed message, inserting some specific data that would cause the error condition and then sending the message to another user. If the recipient opened or previewed the message, the Outlook Express client would either crash or allow the attacker to run whatever code he chose on the users machine.
The code would run with the permission level of the local user.
The patch for this flaw is available here.
Outlook Express is used mainly by home users and some small businesses.
Related Stories:
- Outlook Express Lets Attackers Skirt Filters
- More Security Coverage