Outlook Express Vcard Handler Contains

A security vulnerability exists in Microsoft® Outlook and Outlook Express which could allow a remote attacker to run code of their choice by exploiting an unchecked buffer in the vCard component.

Issue

By creating a vCard and editing it to contain specially chosen data, then sending it to another user, an attacker could cause either of two effects to occur if the recipient opened it. In the less serious case, the attacker could cause the mail client to fail. If this happened, the recipient could resume normal operation by restarting the mail client and deleting the offending mail. In the more serious case, the attacker could cause the mail client to run code of her choice on the user’s machine. Such code could take any desired action, limited only by the permissions of the recipient on the machine.

Because the component that contains the flaw ships as part of OE, which itself ships as part of IE, the patch is specified in terms of the version of IE rather than OE or Outlook.

Affected Products

• Microsoft Outlook and Outlook Express

Download

Patch: http://www.microsoft.com/windows/ie/download/critical/q283908/default.asp

Further Details

Source: Microsoft Corporation

Reference: Microsoft Corporation

Updated: March 23, 2001

>> Recommended Download - secure your PC from spyware, adware and malware now with Spyware Doctor <<