Application security, Patch/Configuration Management, Vulnerability Management

Microsoft email application flaw targets Vista users

Researchers have reported a vulnerability in Microsoft Vista's email client, Windows Mail, which could allow remote attackers to execute code.

Cybercrooks have persuaded users to click on a malicious URL that attempts to exploit the flaw by sending a specially crafted email, according to an IBM Internet Security Systems X-Force advisory released over the weekend.

The advisory labeled the bug "medium risk" because it requires user interaction to be exploited.

The vulnerability exists because Windows Mail "might allow user-assisted remote attackers to execute certain programs via a link to a local file or UNC [universal naming convention] share pathname in which there is a directory with the same base name as an executable program at the same level," according to a National Vulnerability Database summary.

UNC is a filename format used to indicate the location of directories or resources to be accessed.

A Microsoft spokesman said the software giant was investigating, but was not aware of any attacks exploiting the flaw.

Vista deployment rates are still low within the enteprise, with most analysts expecting the rollover to come in the next 18 to 24 months.

Click here to email reporter Dan Kaplan.

Looking for a new job? SC Magazine's Jobs page is the perfect place to check out new IT security employment opportunities.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.