Microsoft plans to release an Outlook security patch in the wake of the devastation wrought by the Loveletter (aka Love Bug) virus, a Visual Basic (VB) Script bug that propagated by exploiting Outlook's address book feature to pass itself along as an email attachment. This patch makes it harder for viruses such as Loveletter to gain access to Outlook's address book.
The security patch prevents an Outlook user from opening any attachment that contains Level 1 Security Files (attachments with executable code), including .exe files, .com files, .bat files, .vbs files, and .js files or any links that might link to executable code including .url files, .isn files, .lnk files, and .pif files. The patch also warns a user accessing Level 2 Security Files (attachments with .zip or other archive files).
The patch pops up a window that prompts you for positive input when an application attempts to access the Outlook address book. The message reads: An external application is trying to access e-mail addresses you have stored in Outlook. Do you want to allow this? This requirement prevents simple scripts, such as Loveletter, from opening your address book without your knowledge and using the email addresses there. The prompt asks you to specify a length of time that you'll allow automated access to the address book. You can choose 1, 2, 5, or 10 minutes or you can refuse access. The original suggestion for this patch came, not from a techie, but from US Congressman Anthony Weiner of New York in a US Senate Subcommittee hearing in the wake of Loveletter.
The patch also bumps up Outlook's default security from Internet Zone to Restricted Zone. Of course, in disabling automated access to address book functionality, Microsoft's fix interferes with the functioning of many third-party products that depend on such access. The fix affects products from Novell, Palm, Accountmate, Great Plains Software, Chapura, FileNET, Instinctive, Micro Eye, Motiva, Paragan Software, Pumatech, Rim, Slipstick Systems, and others.
This patch marks the first time that Microsoft has had to remove a feature to respond to a security crisis. Microsoft representatives called this patch unprecedented. "In today's growing environment of cyberterrorism, Microsoft believes that stronger security options should be built into Outlook." Patches are available for Outlook 2000 and Outlook 98. For more information and the patch itself, see Microsoft's Web site. According to a Microsoft spokesperson, the patch will be available sometime during the week ending May 26.