Long File Name Issue Affecting Microsoft® Outlook 98 and Outlook Express 4.01

A buffer overflow in the way Microsoft email clients handle file attachments with extremely long file names has created a security vulnerability that could potentially allow a skilled hacker to use a malicious email message to run arbitrary computer code contained in the long string.

Issue

When the email client receives a malicious mail or news message that contains an attachment with a very long filename, it could cause the email client to shut down unexpectedly. These very long filenames do not normally occur in mail or news messages, and must be intentionally created by someone with malicious intent. A skilled hacker could use this malicious email message to run arbitrary computer code contained in the long string.

This issue can cause one of the following to occur when attempting to download, open or view an mail or news message in Microsoft Outlook 98 or Microsoft Outlook Express 4.x that has an attachment with a very long filename.

• An error message similar to the following may be displayed: This program has performed an illegal operation and will be shut down. If the problem persists, contact the program vendor.
• Outlook 98 or Outlook Express may terminate unexpectedly.

Affected Products

• Microsoft Outlook 98 & Outlook Express 4.01

Solution

Microsoft Outlook 98
Customers using Microsoft Outlook 98 for Windows 95, Windows 98 or Windows NT 4.0 should download the updated Outlook 98 patch from Office Update at http://officeupdate.microsoft.com/downloadDetails/outptch2.htm

Microsoft Outlook Express 4.01
Customers using Microsoft Outlook Exoress 4.01 should upgrade to the lastest version at http://www.microsoft.com/windows/ie/download

Further Details

Source: Microsoft Corporation

Updated: August 11, 1998

>> Recommended Download - secure your PC from spyware, adware and malware now with Spyware Doctor <<