MSN security hole could run code

News

MSN security hole could run code

A security hole deemed "critical" by Microsoft could allow an attacker to run code of their choice on a vulnerable PC by exploiting a problem in Microsoft's MSN Chat, MSN Messenger and Exchange Instant Messenger products, Microsoft said in a security alert.

Microsoft's chat problem comes three days after the announcement of a security hole in rival America Online's Instant Messenger application that could have allowed attackers to run programs of their choice. AOL has since patched that flaw.

Microsoft has patched the vulnerability, which comes in an ActiveX control that allows users of MSN Chat, Messenger and Exchange Instant Messenger to group together in a single "space" to chat in real time.

A buffer overflow in the component could allow an attacker to assault the flaw and run any code against vulnerable machines. An attacker could also exploit the vulnerability using a malicious Web site or through e-mail formatted in HTML (Hypertext Markup Language).

The ActiveX component that allows the chat feature is included with MSN Messenger 4.5 and higher and Exchange Instant Messenger. MSN Chat users and Windows XP users, however, would be vulnerable to the bug only if they had downloaded and installed the chat component separately, Microsoft said.

E-mail users are protected if they have downloaded the Outlook E-Mail Security Update or are running Outlook 2002 or Outlook Express, the company said.

More information about the vulnerability, and a patch to repair it, are available at www.microsoft.com/technet/security/bulletin/ms02-022.asp

Email Alerts

Register now to receive ComputerWeekly.com IT-related news, guides and more, delivered to your inbox.
By submitting your personal information, you agree to receive emails regarding relevant products and special offers from TechTarget and its partners. You also agree that your personal information may be transferred and processed in the United States, and that you have read and agree to the Terms of Use and the Privacy Policy.
 

COMMENTS powered by Disqus  //  Commenting policy