Microsoft fixes flaw capable of killing Hotmail
Published: 16 Oct 2003 10:45 BST
Responding to a warning from a maker of antivirus software, Microsoft has fixed a security flaw in Hotmail that would have left the widely used Web-based email service vulnerable to collapse at the hands of online vandals.
Finjan Software said on Wednesday that it told Microsoft of the flaw on 8 October and that the software giant fixed the problem within 24 hours. The vulnerability could have allowed an attacker to use the interactions between Hotmail components to expose a user's address book and send emails. The two functions could have been used to start a Hotmail worm that would have spread whenever a user opened up an infected email, said Menashe Eliezer, manager of Finjan's virus research lab.
"You could read the contact list and send email," Eliezer said. "A worm would have propagated quickly," potentially crippling the network.
Microsoft has been plagued by security concerns. In May, the company scrambled to close a hole in its Passport identity-management system, which acts as the gatekeeper for the Hotmail system and other Microsoft online services. The company recently announced new attempts to secure its customers' systems, including patches that are easier to manage, a focus on default security settings and an initiative to educate its users.
In the case of this most recent Hotmail flaw, the service's active content filter, which polices the activities of ActiveX controls, did not adequately block all scripts, according to Finjan. ActiveX controls are Internet programs that add interactivity to Web sites and run on a computer as if they were the user of that machine. Any system that accessed Hotmail email messages could be affected by the flaw.
Because the service itself was flawed, the fix was easy to apply and took effect immediately, Eliezer said.
Microsoft confirmed that it had received a warning from Finjan and fixed the flaw, but it wouldn't immediately comment on how the flaw escaped its nearly two-year effort, known as the Trustworthy Computing Initiative, to secure its systems.
Did you find this article useful?
57 out of 105 people found this useful
- Share this article:
Full Talkback thread
4 comments
-
Ever time I call up my hotmail acc'nt I can not ge... dave lockard -
I cannot access my hotmail account from Ie. After... smokeydog
-
Since Dec 1st, I can't seem to get into my hotmail... Anonymous
-
Evertime I try to go to Hotmail,nothing happens.
I... Jannette Dalrymple
