Secunia

http-equiv has reported a security issue in Microsoft Outlook, potentially allowing malicious people (spammers) to verify if a recipient has read an email.

Outlook 2003 is supposed to protect against objects being loaded from external resources when reading emails. However, it is possible to cause Outlook to load certain XML objects from external web servers. This can be exploited to verify the existence of recipients, but may also allow loading of content, which would be filtered by other email filters.

Additionally, http-equiv has reported that it is possible to spawn a password dialog box, using a style sheet with reference to a website using .htaccess style authentication. This could potentially be used to trick users into entering passwords to sensitive systems.

These issues has been reported to affect Outlook 2003. Other versions may also be affected by similar issues, however, they do not promise to protect the users in the same way as Outlook 2003.

Solution
This has reportedly been silently fixed by one of the latest Office updates dated 14th May or 17th May.

Provided and/or discovered by
http-equiv

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area