Update: Microsoft rethinks latest security patch

Upgrades fix for Outlook from 'important' to 'critical'

By Paul Roberts

March 10, 2004 12:00 PM ET

IDG News Service - One day after releasing a trio of security patches, Microsoft Corp. is upgrading the seriousness of one of those fixes to "critical."
The software update attached to security bulletin MS04-009 was initially described as an "important" patch (see story). The change follows "continued evaluation" by Microsoft's Security Response Center, a company spokesman wrote in an e-mail today.
Microsoft defines "critical" bulletins as those concerning software vulnerabilities that, if exploited, "could allow the propagation of an Internet worm without user action." "Important" bulletins concern vulnerabilities that, if exploited, "could result in compromise of the confidentiality, integrity, or availability of users' data, or of the integrity or availability of processing resources," according to the company's Web site.
The change in severity for MS04-009 came after Microsoft learned of a "new attack scenario discovered after the bulletin's original release on March 9," the spokesman said in the e-mail.
MS04-009 fixes a problem with the way the Outlook e-mail software treats URLs that use the "mailto" tag, which allows Web page authors to insert links on Web pages that launch Outlook or other e-mail clients.
A problem with the way Outlook interprets mailto URLs could allow an attacker to use a specially formatted mailto URL to gain access to files on an affected system or insert and run malicious computer code. The flaw is rated "important," Microsoft said.
Microsoft initially claimed that only computers with the Outlook Today home page were vulnerable to attack. Outlook Today is the home page only until an e-mail account is created, Microsoft said.
However, following release of the bulletin, Finnish security researcher Jouko Pynnonen, who discovered the vulnerability, informed the company that malicious hackers could attack vulnerable Outlook installations even if Outlook Today isn't the default home page, the spokesman said.
In a revised version of its security bulletin, Microsoft noted the discrepancy.
"This vulnerability could also affect users who do not have the 'Outlook Today' folder home page as their default home page in Outlook 2002," the company said.
The change in status doesn't affect the software patch. Microsoft customers who have already installed the security update don't need to take further action, Microsoft said.

Reprinted with permission from

IDG.net
Story copyright 2009 International Data Group. All rights reserved.

Recommend Digg Twitter ShareThis

Email Print Send Feedback Reprints

Additional Resources

Xerox

Win a color printer!

By using solid ink technology only from Xerox, you could save up to 65% by printing color for the cost of black and white. Enter for a chance to WIN a PhaserTM 8860 network color printer!

Microsoft

Upgrade to Internet Explorer 8 today.

Save time and mitigate security risk. Deploy it now.

Sybase

NEXT-GENERATION MOBILITY PLATFORMS

In this white paper, IDC analyzes the role of next-generation mobile enterprise platforms as organizations seek a more strategic deployment of mobile solutions.

Learn the important issues you must consider before starting your next mobility initiative. Get your mobility white paper from IDC now, compliments of Sybase.

White Papers & Webcasts

Centralized Data Backup and Your WAN
Is your organization prepared to tackle the massive challenge of protecting your data in a cost effective and timely manner? With a growing...

Why Compliance Pays
This OnDemand webcast explores the relationship that firms with best compliance records have higher revenue, greater customer retention, lower financial losses from data...

An All-in-One Approach to Web Security
Granting web access to employees poses challenges to IT administrators and introduces unique security risks. Even as companies have perfected their security techniques...

Best Practices for Managing Business Risks from the Use of IT
(Source: Symantec) Based on exhaustive benchmarks conducted by the IT Policy Compliance, this session highlights the relationship between business risks and use of...

The Hidden Dangers of Spam
Beyond the well-understood productivity drain that spam inflicts on businesses, threats posed by illicit email circulating through a network are causing many security...

Managing And Protecting Your Ever Increasing Mobile Assets
(Source: Absolute Software) Your users are becoming more mobile each day. This is great for productivity - yet challenging for IT control. Natalie...

Open Source Security Myths Dispelled
(Source: Astaro) Open Source Software is computer software whose source code is available to the general public. This openly viewable nature...

Sun OpenSSO Enterprise Webinar
(Source: Sun) This webinar replay discusses Sun OpenSSO Enterprise innovation--the single, open-source solution that helps your business solve the challenges around internal access...

Best Practices for Backing Up VMware® with Veritas NetBackup™
VMware® is used by enterprises large and small to increase the efficiency and cost-effectiveness of their IT operations. With this in mind, Symantec...

Agile Enterprise Content Management (ECM) for Rapid ROI
(Source: IBM) Content rich business processes are a core feature of daily operations at just about any organization today. Very often these essential...

All White Papers | All Webcasts