Microsoft Outlook security hole lets attackers in without opening a tainted message

“There are at the least two extra confirmed CVEs which have but to be patched, (each of) which result in full NTLM [Network Trust Level Manager] compromise, so the chance continues to be there,” Gorelik informed CSO On-line on Wednesday. 

The opening, which Microsoft has dubbed CVE-2024-38173, permits any e-mail malware to be activated with out the recipient opening the message, courtesy of Outlook’s fashionable e-mail preview operate. However even for individuals who will not be utilizing mail preview, the malware continues to be more likely to be activated, as most company workers would doubtless open these messages. They know to not open an unknown attachment or click on on an surprising hyperlink, however this assault methodology requires neither of these actions.

“The invention of CVE-2024-38173 highlights a crucial flaw within the form-based structure of Outlook, the place an attacker with entry to an account can craft and propagate a malicious type that evades detection as a result of a defective deny record implementation,” Gorelik stated.