Security hole in MSN Chat, Messenger, could run code
A security hole deemed "critical" by Microsoft Corp. could allow an attacker to run code of their choice on a vulnerable PC by exploiting a problem in Microsoft's MSN Chat, MSN Messenger and Exchange Instant Messenger products, Microsoft said in a security alert Wednesday. The company has patched the vulnerability.
The vulnerability comes in an ActiveX control that allows users of MSN Chat, Messenger and Exchange Instant Messenger to group together in a single "space" to chat in real time, Microsoft said. A buffer overflow in the component could allow an attacker to assault the flaw and run any code against vulnerable machines, Microsoft said. An attacker could also exploit the vulnerability using a malicious Web site or through e-mail formatted in HTML (Hypertext Markup Language), the Redmond, Washington, company said.
The ActiveX component that allows the chat feature is included with MSN Messenger 4.5 and higher and Exchange Instant Messenger, Microsoft said. MSN Chat users and Windows XP users, however, would only be vulnerable to the bug if they had downloaded and installed the chat component separately, Microsoft said.
E-mail users are protected if they have downloaded the Outlook E-Mail Security Update or are running Outlook 2002 or Outlook Express, the company said.
More information about the vulnerability, and a patch to repair it, are available at http://www.microsoft.com/technet/security/bulletin/ms02-022.asp.
Microsoft's chat problem comes three days after the announcement of a security hole in rival America Online Inc.'s Instant Messenger application that could have allowed attackers to run programs of their choice. That flaw has since been patched by AOL.
» posted by abennett
IDG News Service
Symantec Backup Exec 12 and Backup Exec System Recovery 8 deliver industry leading Windows data protection and system recovery. Download this whitepaper to find out the top reasons to upgrade and how to get continuous data protection and complete system recovery.
Data and system loss — from a hard drive failure, malicious attack, natural disaster, or simple human error — can happen anytime. Don’t leave your business vulnerable. Make sure you have a secure recovery strategy in place. Symantec's latest backup and system recovery technology can efficiently restore critical applications, individual emails and documents and even restore your entire system in minutes in the event of a loss.
Businesses face a growing challenge to ensure that the IT environment is properly protected. Backup Exec 12 integrates with other applications in the Symantec family of products, to complement your current data protection strategy, keep your data securely backed up and make it recoverable when you need it most.
