Article ID: 267884 - View products that this article applies to.
This article was previously published under Q267884
For information about the differences between Microsoft Outlook Express and Microsoft Outlook e-mail clients, click the following article number to view the article in the Microsoft Knowledge Base:
(http://support.microsoft.com/kb/257824/EN-US/ )OL2000: Differences Between Outlook and Outlook Express
Microsoft has discovered a vulnerability that affects Microsoft Outlook and Microsoft Outlook Express versions that you installed before the release of Microsoft Internet Explorer 5.01 Service Pack 1 (SP1). This vulnerability enables a user to run malicious code on a computer through the buffer overflow of the e-mail header. The buffer overflow can cause Outlook or Outlook Express to stop responding, or enable arbitrary code to run on your computer. This code can take any action that an authorized user of the computer may want.
Additional information about this issue is available from the following Microsoft Web site:
http://www.microsoft.com/technet/security/bulletin/ms00-043.mspxYou can find frequently asked questions about this vulnerability on the following Microsoft Web site:
This behavior occurs because a component, used by both Outlook and Outlook Express, contains an unchecked buffer in the module that interprets e-mail header fields when certain e-mail protocols are used to download mail from a mail server.
To resolve this issue, use one of the following methods:
Error Message When You Try to Install the Security UpdateThis update may not appear when you click Product Updates on the Microsoft Windows Update Web site, or you may receive the following message when you try to install this update from the Microsoft Download Center Web site:
Updates are available only for Internet Explorer 5.01. Microsoft Internet Explorer versions 4.0, 4.01, 4.01 Service Pack 1, and 5, are also vulnerable to this issue, but when you run the update on a version of Internet Explorer earlier than Internet Explorer 5.01, you receive the message that is noted in this section. This update is not listed as a critical update on the Microsoft Windows Update Web site unless you are running Internet Explorer 5.01.
This update does not need to be installed on this system.
Microsoft recommends that you upgrade to Internet Explorer 5.01 and then install this update.
For information about how to determine the version of Internet Explorer that you are using, please see the following article in the Microsoft Knowledge Base:
(http://support.microsoft.com/kb/164539/EN-US/ )How to Determine Which Version of Internet Explorer is Installed
E-mail Client Does Not WorkIf your e-mail client does not work as a result of this vulnerability, contact the administrator of the e-mail server and request that the e-mail message be deleted. Although you can restart Outlook or Outlook Express if the offending e-mail message is still on the server, the next time that you retrieve e-mail from the server, it causes your e-mail client to not work again.
NOTE: The vulnerability does not cause any damage to the e-mail server because it is an e-mail client-side issue.
For additional information about Internet Explorer 5.01 SP1, click the following article numbers to view the articles in the Microsoft Knowledge Base:
261268For additional information about Internet Explorer on Microsoft Windows 2000 and Microsoft Windows XP, click the following article number to view the article in the Microsoft Knowledge Base:
(http://support.microsoft.com/kb/261268/EN-US/ )Description of Internet Explorer 5.01 Service Pack 1
(http://support.microsoft.com/kb/257249/EN-US/ )Download-Only Setup of Internet Explorer on Windows 2000 and Windows XP
Article ID: 267884 - Last Review: August 30, 2007 - Revision: 5.3