Article ID: 283908 - Last Review: August 30, 2007 - Revision: 4.4 OLEXP: Patch Available for Malformed vCard VulnerabilityThis article was previously published under Q283908 On This PageSYMPTOMS
Microsoft has released a patch that eliminates a security vulnerability that affects Outlook and Outlook Express. A malicious user can use the vulnerability to create a virtual business card (vCard); if the vCard is opened, the malicious user can use the vCard to take any action on the recipient's computer. Outlook Express provides several components that Outlook uses if it is installed on a computer. One such component, which is used to process vCards, has an unchecked buffer. If a malicious user creates a vCard, edits the vCard to contain specially chosen data, and then sends the vCard to another user, either of following symptoms might occur if the recipient opens the vCard:
RESOLUTION
To resolve this issue, apply the patch that is described in this "Resolution" section. Although this vulnerability affects Outlook Express 5.01 and Outlook Express 5.5, this patch can only be applied to Outlook Express 5.5. To successfully apply this patch, perform one the following steps (as applicable) before you apply the patch:
Internet Explorer 5.5 with Service Pack 1To resolve this problem, obtain the latest service pack for Internet Explorer version 5.5. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:276369
(http://support.microsoft.com/kb/276369/EN-US/
)
How to Obtain the Latest Internet Explorer 5.5 Service Pack
For your convenience, the individual patch is also available from the Microsoft Download Center:
Collapse this image  119591
(http://support.microsoft.com/kb/119591/EN-US/
)
How to Obtain Microsoft Support Files from Online Services
Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help to prevent any unauthorized changes to the file.
The English version of this fix should have the following file attributes or later:
Date Time Version Size File name --------------------------------------------------------- 01/15/2001 03:08p 5.50.4701.1500 454,928 Wab32.dll Internet Explorer 5.01 with Service Pack 1A supported fix is now available from Microsoft, but it is only intended to correct the problem that is described in this article. Apply it only to computers that you determine are at risk of attack. Evaluate your computer's physical accessibility, network and Internet connectivity, and other factors to determine the degree of risk to your computer. See the associated Microsoft Security Bulletin (http://www.microsoft.com/technet/security/bulletin/ms01-012.mspx) to help determine the degree of risk. This fix may receive additional testing. If your computer is sufficiently at risk, Microsoft recommends that you apply this fix now. Otherwise, wait for the next Internet Explorer 5.5 service pack that contains this fix.To resolve this problem immediately, download the fix by following the instructions later in this article or contact Microsoft Product Support Services to obtain the fix. For a complete list of Microsoft Product Support Services phone numbers and information about support costs, visit the following Microsoft Web site: http://support.microsoft.com/default.aspx?scid=fh;EN-US;CNTACTMS
(http://support.microsoft.com/default.aspx?scid=fh;en-us;cntactms)
NOTE: In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional determines that a specific update will resolve your problem. The usual support costs will apply to additional support questions and issues that do not qualify for the specific update in question.The following file is available for download from the Microsoft Download Center: Collapse this image 119591
(http://support.microsoft.com/kb/119591/EN-US/
)
How to Obtain Microsoft Support Files from Online Services
Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help to prevent any unauthorized changes to the file.
The English version of this fix should have the following file attributes or later:
Date Time Version Size File name --------------------------------------------------------- 01/15/2001 03:08p 5.50.4701.1500 454,928 Wab32.dll International versions of this hotfix are now available for:
FR = French
These security fixes for wab32.dll apply to IE 5.5/SP1, IE 5.01, IE 5.01/SP1, IE 5.01/SP2. Wab32.dll from IE 5.5/SP1 and IE 5.01/SP2 are identical. In IE 5.5sp2, this fix is already included.ES = Spanish DE = German KO = Korean JA = Japanese CN = Chinese (PRC) TW = Chinese (Taiwan) See below hotfix details and download information: The hotfix installer for name for all International versions of this hotfix will be called Q283908.exe you can obtain it individually for each language above, but you may need to contact Microsoft directly to obtain these International versions of the hotfix. The French version of this fix should have the following file attributes: Date Time Version Size File name ------------------------------------------------------ 01/26/2001 06:17 5.50.4701.1500 454,928 Wab32.dll Date Time Version Size File name ------------------------------------------------------ 01/26/2001 06:17 5.50.4701.1500 454,928 Wab32.dll Date Time Version Size File name ------------------------------------------------------ 01/26/2001 06:15 5.50.4701.1500 454,928 Wab32.dll Date Time Version Size File name ------------------------------------------------------ 01/26/2001 06:16 5.50.4701.1500 454,928 Wab32.dll Date Time Version Size File name ------------------------------------------------------ 01/26/2001 06:16 5.50.4701.1500 454,928 Wab32.dll Date Time Version Size File name ------------------------------------------------------ 01/26/2001 06:15 5.50.4701.1500 454,928 Wab32.dll Date Time Version Size File name ------------------------------------------------------ 01/26/2001 06:16 5.50.4701.1500 454,928 Wab32.dll STATUSMicrosoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article. This problem was first corrected in Internet Explorer version 5.5 Service Pack 2. MORE INFORMATION
For more information about this vulnerability, see the following Microsoft Web site:
http://www.microsoft.com/technet/security/bulletin/ms01-012.mspx
(http://www.microsoft.com/technet/security/bulletin/ms01-012.mspx)
APPLIES TO
| Article Translations
|
| United States | Change | | | All Microsoft Sites |
Back to the top
|
