Mark Litchfield: Microsoft's newest Outlook and Exchange vuln could be awful
The Outlook and Exchange vulnerability disclosed by Microsoft Tuesday has the potential to become a much more virulent problem than the long-hyped Windows Metafile bug patched last week, said one of the email flaw's discoverers Wednesday.
"What I find bizarre is that there's still all this focus on the WMF [Windows Metafile] bug," said Mark Litchfield, the director of NGS Software, a UK-based security company, and one of the two researchers credited by Microsoft with the discovery of the TNEF (Transport Neutral Encapsulation Format) vulnerability.
"This one has massive financial implications if someone exploits it," Litchfield said. The TNEF vulnerability, which Microsoft spelled out in the MS06-003 security bulletin, is a flaw in how Microsoft's Outlook client and older versions of its Exchange server software decode the TNEF MIME attachment. TNEF is used by Exchange and Outlook when sending and processing messages formatted as Rich Text Format (RTF), one of the formatting choices available to Outlook users.
