Results 1 to 4 of 4

Thread: Microsoft warns of security hole in MSN chat

  1. #1
    Join Date
    Sep 2001

    Microsoft warns of security hole in MSN chat

    this is a little snip taken from CNN.com about a hole in MSN chat, just thought it might be intersting....
    go to: http://www.cnn.com/2002/TECH/interne...idg/index.html to read the whole thing.


    Microsoft warns of security hole in MSN chat

    May 10, 2002 Posted: 8:54 a.m. EDT (1254 GMT)
    By Sam Costello

    (IDG) -- A security hole deemed "critical" by Microsoft could allow an attacker to run code of their choice on a vulnerable PC by exploiting a problem in Microsoft's MSN Chat, MSN Messenger and Exchange Instant Messenger products, Microsoft said in a security alert this week. The company has patched the vulnerability.

    The vulnerability comes in an ActiveX control that allows users of MSN Chat, Messenger, and Exchange Instant Messenger to group together in a single "space" to chat in real time, Microsoft said. A buffer overflow in the component could allow an attacker to assault the flaw and run any code against vulnerable machines, Microsoft said. An attacker could also exploit the vulnerability using a malicious Web site or through e-mail formatted in HTML, the Redmond, Washington, company said.

    The ActiveX component that allows the chat feature is included with MSN Messenger 4.5 and higher and Exchange Instant Messenger, Microsoft said. MSN Chat users and Windows XP users, however, would only be vulnerable to the bug if they had downloaded and installed the chat component separately, Microsoft said.

    E-mail users are protected if they have downloaded the Outlook E-Mail Security Update or are running Outlook 2002 or Outlook Express, the company said.

    More information about the vulnerability, and a patch to repair it, are available at http://www.microsoft.com/technet/sec.../ms02-022.asp.

    Microsoft's chat problem comes three days after the announcement of a security hole in rival America Online's Instant Messenger application that could have allowed attackers to run programs of their choice. That flaw has since been patched by AOL. (AOL Time Warner is the parent company of CNN.com.)

  2. #2
    activex components are always all nat secure but again microsoft sucks...

    to be continued
    Bill has the key to the \'blue\' screen
    by tux

  3. #3
    Senior Member
    Join Date
    Aug 2001
    savIRC :: The Multi-Platform IRC Client v. 1.8 [Released 9.04.02]

  4. #4
    Senior Member
    Join Date
    Jan 2002
    Another good reason to switch to Tux. I only use WinXP Pro for business. I use Tux 100% for personal stuff now. I can at least get around in it now.
    The COOKIE TUX lives!!!!
    Windows NT crashed,I am the Blue Screen of Death.
    No one hears your screams.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts