Author Topic: Critical Bug in Outlook  (Read 18908 times)

0 Members and 1 Guest are viewing this topic.

Offline BU508ATopic starter

  • Super Contributor
  • ***
  • Posts: 4531
  • Country: de
  • Per aspera ad astra
Critical Bug in Outlook
« on: February 15, 2024, 07:16:22 am »
stumbled over this a few minutes ago:

https://infosec.exchange/@briankrebs/111931702735845171

Quote:
"Heads up: Microsoft has updated its security advisory for the critical Outlook bug they patched on Tuesday, the one that can be exploited just by a malicious message being viewed in the preview pane. They're now saying it's under active attack.

This remote code execution vulnerability is assigned a CVSS3.1 (badness) score of 9.8."
“Chaos is found in greatest abundance wherever order is being sought. It always defeats order, because it is better organized.”            - Terry Pratchett -
 

Offline eTobey

  • Frequent Contributor
  • **
  • Posts: 797
  • Country: de
Re: Critical Bug in Outlook
« Reply #1 on: February 15, 2024, 07:58:32 am »
I wonder when the corresponding feature, that allows this, was introduced. Any idea?
"Sometimes, after talking with a person, you want to pet a dog, wave at a monkey, and take off your hat to an elephant." (Maxim Gorki)
 

Online coppercone2

  • Super Contributor
  • ***
  • Posts: 9730
  • Country: us
  • $
Re: Critical Bug in Outlook
« Reply #2 on: February 15, 2024, 08:04:09 am »
haha 4 years of asking if i checked my email well no I am keeping your servers safe
 

Offline Halcyon

  • Global Moderator
  • *****
  • Posts: 5730
  • Country: au
Re: Critical Bug in Outlook
« Reply #3 on: February 15, 2024, 12:51:00 pm »
Good find! Thankfully it's limited to older versions of Outlook. If you're one of these users, update straight away!
 

Offline SeanB

  • Super Contributor
  • ***
  • Posts: 16308
  • Country: za
Re: Critical Bug in Outlook
« Reply #4 on: February 15, 2024, 02:24:50 pm »
Yet how many enterprise users or business users ever update Outlook, especially if the have older versions that "still work" and are paid for, not the current rental option. I know many government offices still use Outlook 2002, with it never having had any patches or updates applied, and there are still a good number of places running on XP, including a lot of government offices.
 

Offline eTobey

  • Frequent Contributor
  • **
  • Posts: 797
  • Country: de
Re: Critical Bug in Outlook
« Reply #5 on: February 16, 2024, 11:03:22 am »
haha 4 years of asking if i checked my email well no I am keeping your servers safe

If you would use some things like "," ".", then one may understand what you are writing.
"Sometimes, after talking with a person, you want to pet a dog, wave at a monkey, and take off your hat to an elephant." (Maxim Gorki)
 

Online SiliconWizard

  • Super Contributor
  • ***
  • Posts: 14681
  • Country: fr
Re: Critical Bug in Outlook
« Reply #6 on: February 16, 2024, 09:21:35 pm »
Do people still use Outlook?
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 6952
  • Country: ca
Re: Critical Bug in Outlook
« Reply #7 on: February 16, 2024, 10:36:21 pm »
You forget to post the update. MS just admitted it is not an issue.
Quote
Feb 14, 2024
Mistakenly updated exploited flag and exploitability assessment to indicate exploitation existed. Reverting values to no
Facebook-free life and Rigol-free shack.
 

Offline Halcyon

  • Global Moderator
  • *****
  • Posts: 5730
  • Country: au
Re: Critical Bug in Outlook
« Reply #8 on: February 17, 2024, 04:08:55 am »
You forget to post the update. MS just admitted it is not an issue.
Quote
Feb 14, 2024
Mistakenly updated exploited flag and exploitability assessment to indicate exploitation existed. Reverting values to no

 

Offline Halcyon

  • Global Moderator
  • *****
  • Posts: 5730
  • Country: au
Re: Critical Bug in Outlook
« Reply #9 on: February 18, 2024, 10:23:46 pm »
Looks like it has been actively exploited.

https://twitter.com/xaitax/status/1759318090788037093
 

Offline nightfire

  • Frequent Contributor
  • **
  • Posts: 585
  • Country: de
Re: Critical Bug in Outlook
« Reply #10 on: February 18, 2024, 11:37:26 pm »
Yes, lots of them. In private, my stuff is web-based or on alternative mailclients, but in a corporate environment, that is centered around a windows domain, you quite often have an exchange server and Outlook as its native and natural client.

I tried to pitch some proposal to replace the Exchange system at my workplace last year, but quickly realized that all the alternatives in the Linux world like Zimbra lacked some features or functionality- so boss did not approve of this.
 

Offline Halcyon

  • Global Moderator
  • *****
  • Posts: 5730
  • Country: au
Re: Critical Bug in Outlook
« Reply #11 on: February 18, 2024, 11:43:07 pm »
Yes, lots of them. In private, my stuff is web-based or on alternative mailclients, but in a corporate environment, that is centered around a windows domain, you quite often have an exchange server and Outlook as its native and natural client.

I tried to pitch some proposal to replace the Exchange system at my workplace last year, but quickly realized that all the alternatives in the Linux world like Zimbra lacked some features or functionality- so boss did not approve of this.

Hosting your own Exchange servers is a big old-school these days, however I can understand why large businesses haven't moved over to something like M365 yet. It would be a huge undertaking, but it's bound to happen one day. Microsoft wants everyone in the cloud, whether it be for email, office applications or Windows itself.
 

Offline nightfire

  • Frequent Contributor
  • **
  • Posts: 585
  • Country: de
Re: Critical Bug in Outlook
« Reply #12 on: February 19, 2024, 12:22:58 am »
Lets say, in some environments it is becoming the new "modern-School"- because the disadvantages of being trapped in a cloud service and costs become more and more visible.

My company also is based in EU and has some "KRITIS" customers. Therefore we are working in an environment with some enhanced data security and privacy guidelines, where a move to MS Cloud would put lots of things in a legal grey area.
Why? Simply because MS in their glossy papers claim that of course they would honor the EU law such as GDPR, but the formulations in their terms of usage and other contracts (which are the legally binding type) do not speak in such a struct manner. Also it is known that a US-based company in interest of national security HAS to abide to government orderings when told to do so.

And as long a company can not get rid of their existing exchange servers infrastructure (often due to political reasons within management), it is safer to keep the systems on-premise or in a hosted datacenter where one has full authority over the systems.
 

Offline Halcyon

  • Global Moderator
  • *****
  • Posts: 5730
  • Country: au
Re: Critical Bug in Outlook
« Reply #13 on: February 19, 2024, 12:45:51 am »
Sure and I fully get your points. There are advantages and disadvantages of both on-prem vs. cloud solutions. It just depends on your company and requirements.

I just foresee a day where on-prem Exchange will be no more.
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf