A security hole deemed "critical" by Microsoft could allow an
attacker to run code of their choice on a vulnerable PC by
exploiting a problem in Microsoft's MSN Chat, MSN Messenger and
Exchange Instant Messenger products, Microsoft said in a security
alert.
Microsoft's chat problem comes three days after the announcement of
a security hole in rival America Online's Instant Messenger
application that could have allowed attackers to run programs of
their choice. AOL has since patched that flaw.
Microsoft has patched the vulnerability, which comes in an ActiveX
control that allows users of MSN Chat, Messenger and Exchange
Instant Messenger to group together in a single "space" to chat in
real time.
A buffer overflow in the component could allow an attacker to
assault the flaw and run any code against vulnerable machines. An
attacker could also exploit the vulnerability using a malicious Web
site or through e-mail formatted in HTML (Hypertext Markup
Language).
The ActiveX component that allows the chat feature is included with
MSN Messenger 4.5 and higher and Exchange Instant Messenger. MSN
Chat users and Windows XP users, however, would be vulnerable to
the bug only if they had downloaded and installed the chat
component separately, Microsoft said.
E-mail users are protected if they have downloaded the Outlook
E-Mail Security Update or are running Outlook 2002 or Outlook
Express, the company said.
More information about the vulnerability, and a patch to repair it,
are available at
www.microsoft.com/technet/security/bulletin/ms02-022.asp