Feeds

Guninski finds new ActiveX security hole in OXP

Outlook strikes again...

  • alert
  • submit to reddit

Remote control for virtualized desktops

Bug hunter extraordinary Georgi Guninski has posted a tetchy warning of a new security hole in Office XP. As Georgi says, "MS Office XP - the more money I give to Microsoft, the more vulnerable my Windows computers are."

In this case Office XP installs an ActiveX control called "Microsoft Outlook View Control." This exposes a property called "selection" which allows access to a user's email messages. It also, says Guninski, exposes the Outlook "Application" object, which could allow execution of arbitrary programs on the user's computer. This could allow an intruder to take full control of the user's computer.

Guninski says he alerted Microsoft to the problem on the 9th of July, and that he understands they're investigating it. In the meanwhile Office XP can visit his demo of the feature here, (it's quite cute) and then (says Georgi) uninstall Office XP and Windows. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
Euro Parliament VOTES to BREAK UP GOOGLE. Er, OK then
It CANNA do it, captain.They DON'T have the POWER!
Download alert: Nearly ALL top 100 Android, iOS paid apps hacked
Attack of the Clones? Yeah, but much, much scarier – report
NSA SOURCE CODE LEAK: Information slurp tools to appear online
Now you can run your own intelligence agency
Post-Microsoft, post-PC programming: The portable REVOLUTION
Code jockeys: count up and grab your fabulous tablets
Twitter App Graph exposes smartphone spyware feature
You don't want everyone to compile app lists from your fondleware? BAD LUCK
Microsoft: Your Linux Docker containers are now OURS to command
New tool lets admins wrangle Linux apps from Windows
prev story

Whitepapers

Go beyond APM with real-time IT operations analytics
How IT operations teams can harness the wealth of wire data already flowing through their environment for real-time operational intelligence.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Why CIOs should rethink endpoint data protection in the age of mobility
Assessing trends in data protection, specifically with respect to mobile devices, BYOD, and remote employees.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Seattle children’s accelerates Citrix login times by 500% with cross-tier insight
Seattle Children’s is a leading research hospital with a large and growing Citrix XenDesktop deployment. See how they used ExtraHop to accelerate launch times.