Flaw in how Outlook 2002 handles V1 Exchange Server: Jan 22

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

eddie5659

Thread Starter
Moderator
Malware Specialist
Joined
Mar 19, 2001
Messages
37,298
Hiya

Issue:
======
Microsoft Outlook 2002 provides the facility to encrypt e-mails
sent between e-mail recipients. Encryption is used to prevent
parties other than the intended recipients from reading the
contents of an e-mail. Outlook uses public key certificates to
facilitate the exchange of the cryptographic keys that are used in
the encryption process, and Outlook offers a number of different
options as to what type of certificates can be used. S/MIME
certificates are the most commonly used (and are not affected by
the vulnerability that is the subject of this bulletin), but there
are other certificate options including V1 Exchange Server Security
certificates.

A vulnerability exists because there is a flaw in the way Outlook
2002 handles a V1 Exchange Server Security certificate when using
it to encrypt e-mail. As a result of this flaw, Outlook fails to
encrypt the mail correctly and the message will be sent in plain
text. This could cause the information in the e-mail to be exposed
when the user believed it to be protected through encryption.

Mitigating Factors:
====================
- -This vulnerability only affects encryption when a V1 Exchange
Server Security certificate is used. S/MIME encryption, which is
the most widely used form of e-mail encryption used by Outlook, is
not affected.

- -This vulnerability only affects Outlook 2002 and only when sending
HTML e-mail.


Maximum Severity Rating: Moderate

Affected Software:

Microsoft Outlook 2002

Download locations for this patch

Microsoft Outlook 2002:

http://microsoft.com/downloads/deta...4B-E458-48F0-B0CB-7E73C0BB4884&displaylang=en

(administrative update only)

http://www.microsoft.com/office/ork/xp/journ/olk1006a.htm

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-003.asp

Regards

eddie
 
Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Top