Microsoft Outlook vulnerability exposed

IT departments are being warned of a vulnerability which exists in Microsoft Outlook that might let a malicious attacker manipulate users' inboxes.

The vulnerability, reported on a Windows IT Security newsletter, originates from the Outlook View Control ActiveX control, which lets users view Outlook mail folders from a web page. The ActiveX control exposes a function that might let the web page manipulate Outlook data and subsequently lets the malicious attacker delete mail, change calendar information and run a piece of code in a user's machine.

Microsoft has released a security bulletin entitled MS-01-03b. A patch will be available in the near future, but as a temporary measure Microsoft recommends applying the Outlook 2000 SR-1 security update and temporarily disabling ActiveX controls in Internet Explorer's internet security zone.

ActiveX Control is a software module based on Microsoft's Component Object Model (COM) architecture. It allows a program to add extra functionality and is typically used in user interface functions.