Microsoft Releases New Patches; Fixes IE Hole

Microsoft Corp. on Tuesday released its monthly batch of patches, including a fix for a flaw in Outlook that allows attackers to run their own code.

The company also published patches for a vulnerability in Windows and another in the MSN Messenger software.

But the weakness in Outlook 2002 is the most serious of the three. The problem involves the way that Outlook handles certain special URLs.

With this security issue, an attacker would need to entice a user to either visit a malicious Web page or open an HTML mail message with the malicious code in it, Microsoft said. The attacker would then be able to access files or run code on the users machine. The code would run in the security context of the user.

The flaw affects only Outlook 2002 and Office XP Service Pack 2.

The vulnerability in Windows results from incorrect handling of TCP/IP connections by two components of Windows Media Services. An attacker who sent a series of specific packets to the listening ports of either the Windows Media Station Service or the Windows Media Monitor Service could cause the service to stop responding, resulting in a denial-of-service.

This issue affects Windows NT 4.0, 2000 Professional, XP and Windows Server 2003.

/zimages/2/28571.gifWhat is the difference between fish and phish?Click hereto read more about how malware authors architect attacks on browsers.

The flaw in MSN Messenger would allow an attacker to view a file on the users machine by sending a specially formatted request. However, the attacker would need to know the exact location of the file, Microsoft said. This vulnerability applies to MSN Messenger 6.0 and 6.1.

/zimages/2/28571.gifCheck outeWEEK.coms Security Centerat http://security.eweek.com for security news, views and analysis. Be sure to add our eWEEK.com security news feed to your RSS newsreader or My Yahoo page:/zimages/2/19420.gifhttp://us.i1.yimg.com/us.yimg.com/i/us/my/addtomyyahoo2.gif