Vulnerability affecting Microsoft Outlook
January 10th, 2006John Heasman and Mark Litchfield of NGSSoftware have discovered a critical
vulnerability affecting Microsoft Outlook. The vulnerable versions include:
Microsoft Outlook 2000 (inc. Microsoft Office 2000 Service Pack 3 and
Multilanguage packs)
Microsoft Outlook 2002 (inc. Microsoft Office XP Service Pack 3 and
Multilingual UI packs)
Microsoft Outlook 2003 (inc. Microsoft Office 2003 Service Pack 1, Service
Pack 2 and
Multilingual UI packs)
The vulnerability potentially allows execution of arbitrary code when the
user previews
or opens a specially crafted email message.
The flaw has now been addressed and patches are available from:
http://www.microsoft.com/technet/security/Bulletin/MS06-003.mspx
NGSSoftware are going to withhold details of this flaw for three months.
Full details will
be published on the 10th April 2006. This three month window will allow
system
administrators the time needed to obtain the patch before the details are
released to the
general public. This reflects NGSSoftware’s approach to responsible
disclosure.
http://www.ngssoftware.com/disclosure.pdf
NGSSoftware Insight Security Research
http://www.ngssoftware.com
http://www.databasesecurity.com/
http://www.nextgenss.com/
+44(0)208 401 0070
