Critical flaws in IE and Outlook discovered

Sidney · 1st April 2005, 18:42

A new set of highly critical flaws have been discovered in Microsoft's Internet Explorer and Outlook programs, according to research company eEye Digital Security.

The vulnerabilities allow for remote code execution with no actions from the computer user, eEye said. Although the flaws would not allow self-propagating worms to infiltrate a system, there is the potential of attackers installing backdoor Trojans with a person's knowledge, Ben Nagy, an eEye senior security engineer, said Friday.

"If a user is tricked (into going) to a site carrying malicious code, they can become infected by just surfing across a banner ad," Nagy said.

eEye notified Microsoft several days ago of the flaws in the default installation of Outlook and IE and is giving the software giant time to develop a patch before releasing details on which versions of the software are affected, Nagy said.

For now, only a few details are included in eEye's page of upcoming advisories.

Nagy added that eEye is also still conducting its own testing of various platforms to evaluate which ones are affected and to what degree.

No exploits are known to have been developed yet, Nagy said.

"Microsoft has acknowledged a vulnerability does exist and is real, but I doubt they will release a patch out of (their monthly) cycle," Nagy said.

Microsoft officials could not be immediately reached for comment.

http://news.com.com/Critical+flaws+i...l?tag=nefd.top

1st April 2005, 18:42	#1
Sidney Member Join Date: Mar 2004 Posts: 15,738	Critical flaws in IE and Outlook discovered A new set of highly critical flaws have been discovered in Microsoft's Internet Explorer and Outlook programs, according to research company eEye Digital Security. The vulnerabilities allow for remote code execution with no actions from the computer user, eEye said. Although the flaws would not allow self-propagating worms to infiltrate a system, there is the potential of attackers installing backdoor Trojans with a person's knowledge, Ben Nagy, an eEye senior security engineer, said Friday. "If a user is tricked (into going) to a site carrying malicious code, they can become infected by just surfing across a banner ad," Nagy said. eEye notified Microsoft several days ago of the flaws in the default installation of Outlook and IE and is giving the software giant time to develop a patch before releasing details on which versions of the software are affected, Nagy said. For now, only a few details are included in eEye's page of upcoming advisories. Nagy added that eEye is also still conducting its own testing of various platforms to evaluate which ones are affected and to what degree. No exploits are known to have been developed yet, Nagy said. "Microsoft has acknowledged a vulnerability does exist and is real, but I doubt they will release a patch out of (their monthly) cycle," Nagy said. Microsoft officials could not be immediately reached for comment. http://news.com.com/Critical+flaws+i...l?tag=nefd.top __________________ lazyman Opteron 165 (2) @2.85 1.42 vcore AMD Stock HSF + Chill Vent II