Microsoft critical VML flaw extends to Outlook 2003

Stan Beer
Friday, 22 September 2006 13:16

Business IT - Security

A critical vulnerability in Microsoft's VML (vector markup language) used to produce graphics, that was at first thought to affect only the Internet Explorer browser and Office 2007, which use VML tags, has been found to also affect the Outlook 2003 email client.

• Announcements

It has been confirmed by Microsoft that Outlook users could be infected by attackers using the VML flaw simply by opening an HTML exail. This makes the flaw far more serious because users no longer have to visit a malicious website to be infected.

At first it was thought that emails would be safe because the malware transmitted by vulnerability required running scripting code, which Outlook would block. However, it has now come to light that scripts are not required as code can be embedded in the VML tags themselves.

Until a patch is released Microsoft advises Outlook 2003 users to run their clients in text only mode.