Security expert warns users to look out with Outlook

A security specialist issued a research note Thursday warning of a handful of flaws in Microsoft's Outlook 2002 e-mail software which he claimed could let "bad guys" cause havoc on a user's computer.

Independent security consultant Richard Smith pointed to four "questionable security policies" in Outlook 2002 which he said Microsoft has yet to fix, even though he notified the company of the problems over the last twelve months, according to Smith's note.

Microsoft did not immediately return calls seeking comment.

Smith said the most critical problem is that Outlook will automatically download potentially dangerous files sent in certain HTML (hypertext markup language) e-mail messages. The warning applied to e-mails with IFRAME HTML tags embedded in the message. If a user reads such an e-mail, Outlook will begin downloading executable files from a Web specified in the message.

"Outlook will put up a dialog box asking a user if they want to open the file, save it, or cancel the download," Smith wrote. "There is no security warning that the executable file might be dangerous. Unfortunately, the default action of the dialog is 'Open'."

Smith recommend that IFRAME tags be used only in conjunction with HTML, image and text files.

Another HTML-related flaw allows JavaScript code to run in e-mails even though scripting is turned off in the default settings of Outlook. A malicious hacker could bury the JavaScript code in a seemingly harmless link, causing hidden dangerous code to execute when the user clicks on a link, he said.

"In Outlook, URLs are limited to about 2,000 characters which is probably enough space to contain a simple worm which could exploit one of the know Internet Explorer security holes," Smith wrote.

In addition, Smith claimed that cookies can be set and read in HTML e-mails despite Outlook's default settings to turn cookies off. Cookies are small programs that collect information about which sites users visit on the Internet. While cookies can make life easier by identifying users when they return to a site, they can also be used to track Internet usage, making them a contentious privacy issue.

Smith contended that Microsoft's Outlook and Internet Explorer development teams disagree on the potential threat posed by .URL files, causing disruptive messages to occasionally appear when working with the two applications.

"The Outlook group sees them as security threat, while the IE group does not," Smith wrote.

He also noted that: "These problems likely affect earlier versions of Outlook as well as Outlook Express."

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Ashlee Vance

Computerworld
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?