Fergie's Tech Blog

eEye: Flaw found in IE, Outlook installation

Dawn Kawamoto writes in C|Net News:

A security flaw has been found in the default installation process for Microsoft's Internet Explorer, Outlook and Outlook Express, according to eEye Digital Security.

A common thread with these applications is the potential for a buffer overflow, which in turn could allow an attacker to gain access to users' systems remotely, said Mike Puterbaugh, eEye's senior director of product marketing.

eEye, which issued an announcement about the problem late last week, noted that systems at risk include those running Windows XP with Service Pack 0 or 1 and Windows 2000. The security specialist noted that it is still conducting reviews of the flaw and could find that other versions of the operating system are affected.

Microsoft is unaware of any attacks involving the reported vulnerability or any customers who have been affected, a company representative said.

The vulnerability is only the latest IE security flaw researchers have discovered since Microsoft released a cumulative update for the browser last month, Puterbaugh said. Other flaws reported in the past few weeks range from a vulnerability with version 6 of the browser on Windows XP with Service Pack 2 to an IE flaw involving the Microsoft DDS Library Shape Control file.

"I wouldn't be surprised to see Microsoft release another cumulative update for IE in the near future," Puterbaugh said.

posted by Fergie @ 9/06/2005 01:19:00 PM