Outlook Express Bug; MSN IM Worm Detected

Datamation content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.

Microsoft has issued a patch for a buffer overflow flaw
in the Outlook Express S/MIME parsing functions that compromises the
security of the e-mail software.

A security bulletin from Microsoft said the
S/MIME code used to verify the authenticity of e-mails sent
with Outlook Express contains a flaw that allows an attacker to create a
digitally signed e-mail and exploit the buffer overflow.

The security flaw, which does not affect the Microsoft Outlook e-mail
client, could cause Outlook Express to execute malicious code on a victim’s
PC. Redmond put a “critical” rating on the vulnerability and said both
Outlook Express 5.5 and 6.0 versions were affected.

It said the vulnerability only affects messages signed with the S/MIME
function and sent to an Outlook Express user. (Download patch here).

Microsoft does not provide details on the cause of the vulnerability but
said an attacker could introduce specific data via the S/MIME encryption
method, then sending it to another user. “In the more serious case, the
attacker could cause the mail client to run code of their choice on the
user’s machine. Such code could take any desired action, limited only by the
permissions of the recipient on the machine,” it said.

“Outlook Express runs in the context of the user. Exploiting this
vulnerability would in the worst-case scenario allow an attacker to run
arbitrary code in the context of the users’ privileges only. Any
restrictions on the users’ account would apply to the attackers code,”
Microsoft warned.

Separately, software security firm TrendMicro announced it had detected a
worm propagating via Microsoft’s MSN instant messenger product.

The company said the Henpeck/W32/Fleming.worm is squirming in the wild by connecting to a certain Web
site to update itself. “It also drops and executes a backdoor malware, which
Trend Micro antivirus detects as BKDR_EVILBOT.A, the company said.

TrendMicro said the worm propagates via MSN Messenger by sending a message
that directs recipients to a URL that contains an executable file. The worm
is written in Visual Basic 6.0.

This worm initiates an MSN chat conversation and then immediately sends out
an IM message to the all active or online contacts in the infected user’s
MSN contact list

The message reads: Hey!! Could you please check out this program for me
🙂 I made it myself and want people to test it. It’s a readme with the
program that explains what it does. The message contains a URL with a
.exe file. If the URL is clicked, the worm is executed and TrendMicro said
it appears to be stealing CD keys from an infected system.

“The worm checks the system registry keys and sends out certain values it
finds to an MSN user named styggefolk@hotmail.com,” the company said.
TrendMicro’s
advisory contains information on removing the worm from an
infected system.