Critical Bug in Outlook - Page 1
Forum section: electronics / general

author: BU508A
author_rank: Super Contributor
timestamp: February 15, 2024, 07:16:22 am
content: stumbled over this a few minutes ago:https://infosec.exchange/@briankrebs/111931702735845171Quote:"Heads up: Microsoft has updated its security advisory for the critical Outlook bug they patched on Tuesday, the one that can be exploited just by a malicious message being viewed in the preview pane. They're now saying it's under active attack.This remote code execution vulnerability is assigned a CVSS3.1 (badness) score of 9.8."

author: eTobey
author_rank: Super Contributor
timestamp: February 15, 2024, 07:58:32 am
content: I wonder when the corresponding feature, that allows this, was introduced. Any idea?

author: coppercone2
author_rank: Super Contributor
timestamp: February 15, 2024, 08:04:09 am
content: haha 4 years of asking if i checked my email well no I am keeping your servers safe

author: Halcyon
author_rank: Unknown
timestamp: February 15, 2024, 12:51:00 pm
content: Good find! Thankfully it's limited to older versions of Outlook. If you're one of these users, update straight away!

author: SeanB
author_rank: Super Contributor
timestamp: February 15, 2024, 02:24:50 pm
content: Yet how many enterprise users or business users ever update Outlook, especially if the have older versions that "still work" and are paid for, not the current rental option. I know many government offices still use Outlook 2002, with it never having had any patches or updates applied, and there are still a good number of places running on XP, including a lot of government offices.

author: eTobey
author_rank: Super Contributor
timestamp: February 16, 2024, 11:03:22 am
content: Quote from: coppercone2 on February 15, 2024, 08:04:09 amIf you would use some things like "," ".", then one may understand what you are writing.

author: SiliconWizard
author_rank: Super Contributor
timestamp: February 16, 2024, 09:21:35 pm
content: Do people still use Outlook?

author: Bud
author_rank: Super Contributor
timestamp: February 16, 2024, 10:36:21 pm
content: You forget to post the update. MS just admitted it is not an issue.Quote

author: Halcyon
author_rank: Unknown
timestamp: February 17, 2024, 04:08:55 am
content: Quote from: Bud on February 16, 2024, 10:36:21 pm

author: Halcyon
author_rank: Unknown
timestamp: February 18, 2024, 10:23:46 pm
content: Looks like it has been actively exploited.https://twitter.com/xaitax/status/1759318090788037093

author: nightfire
author_rank: Frequent Contributor
timestamp: February 18, 2024, 11:37:26 pm
content: Yes, lots of them. In private, my stuff is web-based or on alternative mailclients, but in a corporate environment, that is centered around a windows domain, you quite often have an exchange server and Outlook as its native and natural client.I tried to pitch some proposal to replace the Exchange system at my workplace last year, but quickly realized that all the alternatives in the Linux world like Zimbra lacked some features or functionality- so boss did not approve of this.

author: Halcyon
author_rank: Unknown
timestamp: February 18, 2024, 11:43:07 pm
content: Quote from: nightfire on February 18, 2024, 11:37:26 pmHosting your own Exchange servers is a big old-school these days, however I can understand why large businesses haven't moved over to something like M365 yet. It would be a huge undertaking, but it's bound to happen one day. Microsoft wants everyone in the cloud, whether it be for email, office applications or Windows itself.

author: nightfire
author_rank: Frequent Contributor
timestamp: February 19, 2024, 12:22:58 am
content: Lets say, in some environments it is becoming the new "modern-School"- because the disadvantages of being trapped in a cloud service and costs become more and more visible.My company also is based in EU and has some "KRITIS" customers. Therefore we are working in an environment with some enhanced data security and privacy guidelines, where a move to MS Cloud would put lots of things in a legal grey area.Why? Simply because MS in their glossy papers claim that of course they would honor the EU law such as GDPR, but the formulations in their terms of usage and other contracts (which are the legally binding type) do not speak in such a struct manner. Also it is known that a US-based company in interest of national security HAS to abide to government orderings when told to do so.And as long a company can not get rid of their existing exchange servers infrastructure (often due to political reasons within management), it is safer to keep the systems on-premise or in a hosted datacenter where one has full authority over the systems.

author: Halcyon
author_rank: Unknown
timestamp: February 19, 2024, 12:45:51 am
content: Sure and I fully get your points. There are advantages and disadvantages of both on-prem vs. cloud solutions. It just depends on your company and requirements.I just foresee a day where on-prem Exchange will be no more.