Serious MSN Messenger exploit

MSN Chat control, an ActiveX control installed with MSN Messenger, contains a buffer overflow bug that allows a remote attacker to execute code on a machine which has both MSN Chat control and MSN messenger installed.

MSN Chat control, an ActiveX control installed with MSN Messenger, contains a buffer overflow bug that allows a remote attacker to execute code on a machine which has both MSN Chat control and MSN messenger installed.

According to Microsoft Security Bulletin MS02-022, 'An unchecked buffer exists in one of the functions that handles input parameters in the MSN Chat control. A security vulnerability results because it is possible for a malicious user to levy a buffer overrun attack and attempt to exploit this flaw. A successful attack could allow code to run in the user's context.'

The flaw affects users of MSN Messenger 4.5, MSN Messenger 4.6, MSN Chat control and Microsoft Exchange Messenger 4.5 and 4.6.

This vulnerability has been given a 'critical' severity rating. All users who have the above software installed are advised to download the Microsoft patch.