Finjan Software said Wednesday that it told Microsoft of the flaw Oct. 8 and that the software giant fixed the problem within 24 hours. The vulnerability could have allowed an attacker to use the interactions between Hotmail components to expose a user's address book and send e-mails. The two functions could have been used to start a Hotmail worm that would have spread whenever a user opened up an infected e-mail, said Menashe Eliezer, manager of Finjan's virus research lab.
"You could read the contact list and send e-mail," Eliezer said. "A worm would have propagated quickly," potentially crippling the network.
Microsoft has been plagued by security concerns. In May, the company scrambled to close a hole in its Passport identity-management system, which acts as the gatekeeper for the Hotmail system and other Microsoft online services. The company recently announced new attempts to secure its customers' systems, including patches that are easier to manage, a focus on default security settings and an initiative to educate its users.
In the case of this most recent Hotmail flaw, the service's active content filter, which polices the activities of ActiveX controls, did not adequately block all scripts, according to Finjan. ActiveX controls are Internet programs that add interactivity to Web sites and run on a computer as if they were the user of that machine. Any system that accessed Hotmail e-mail messages could be affected by the flaw.
Because the service itself was flawed, the fix was easy to apply and took effect immediately, Eliezer said.
Microsoft confirmed that it had received a warning from Finjan and fixed the flaw, but it wouldn't immediately comment on how the flaw escaped its nearly two year effort, known as the Trustworthy Computing Initiative, to secure its systems.
Nothing new here.
Microsoft patches - blah blah blah