Microsoft to issue Outlook security patch
- By Ann Harrison
- May 18, 2000
Microsoft Corp. announced this week that it will issue a patch for its popular
Outlook e-mail client that's aimed at preventing the software from propagating
viruses like the "love bug" and Melissa. Those viruses were spread via e-mail
attachments or Internet worms that replicated through the Outlook address
The patch, which is being analyzed by developers, could have a wide-ranging
impact on third-party software designed to interoperate with Outlook.
The recent "I Love You" virus overwhelmed many corporate and government
networks when it triggered Outlook to automatically mail the virus to everyone
in victims' Outlook address books. The upcoming patch will prevent Outlook
2000 and Outlook 98 from receiving certain types of programs files, such
as .exe and .bat, that contain executable code used to spread viruses.
Updated versions of Outlook will also block script modules and files such
as .js, .bas and .vbs Visual Basic script attachments. The love bug virus
payload was a .vbs attachment. Internet links and shortcuts to files such
as .lnk and .pif files will be restricted. "The goal is to take the guesswork
out of determining whether an attachment is safe," said Lisa Gurry, a product
manager with Microsoft's Office team.
Microsoft has made a beta version of the patch available to independent
software vendors whose products may be impacted by the update. The beta,
available at http://officeupdate.microsoft.com/2000/articles/o2ksecISV.htm
is intended only for use by systems administrators and independent software
Microsoft posted a warning on the site that "the beta is not intended to
be placed into production situations and should be deployed only on machines
that can be reformatted after testing without serious concerns." The site
includes a link through which companies can contact Microsoft to report
bugs or provide feedback on the update.
A patch for all Outlook users, known as the Microsoft Outlook 98/2000 E-mail
Security Update, will be available next week.