Microsoft has issued a patch for a buffer overflow flaw in the Outlook Express S/MIME parsing functions that compromises the security of the e-mail software.
A security bulletin from Microsoft (
here) said the S/MIME (define) code used to verify the authenticity of e-mails sent with Outlook Express contains a flaw that allows an attacker to create a digitally signed e-mail and exploit the buffer overflow.
The security flaw, which does not affect the Microsoft Outlook e-mail client, could cause Outlook Express to execute malicious code on a victim's PC. Redmond put a "critical" rating on the vulnerability and said both Outlook Express 5.5 and 6.0 versions were affected.
It said the vulnerability only affects messages signed with the S/MIME function and sent to an Outlook Express user.
Microsoft does not provide details on the cause of the vulnerability but said an attacker could introduce specific data via the S/MIME encryption method, then sending it to another user. "In the more serious case, the attacker could cause the mail client to run code of their choice on the user's machine. Such code could take any desired action, limited only by the permissions of the recipient on the machine," it said.
"Outlook Express runs in the context of the user. Exploiting this vulnerability would in the worst-case scenario allow an attacker to run arbitrary code in the context of the users' privileges only. Any restrictions on the users' account would apply to the attackers code," Microsoft warned.
Download the patch
hereSouce:
Driverheaven 