The vulnerability smoothes the way for a new type of email-borne virus, also called a Trojan horse, and other malicious software. Microsoft Outlook is one of the most popular email programs in use. Programs which exploit the vulnerability, however, fool Outlook into executing the potentially harmful software without asking permission.
Email containing a malicious payload is a popular new method of attacking computers.
For example, US West's internal network had to be shut down for an evening about two weeks ago because of a self-generating attack. The attack works by disguising the true identity of an email attachment so that Outlook assumes the attached file is benign, said the discoverer, Juan Carlos Garcia Cuartango, a Spanish researcher who has found several other weaknesses in the past. Microsoft was unable to comment on the vulnerability by press time. The newly discovered problem affects Microsoft Outlook Express 4 and 5, Outlook 98, and Outlook 2000, according to Elias Levy, chief technology officer of Security Focus , a company that monitors computer security problems. There aren't yet reports of active attacks using the vulnerability, he said.