January 6, 2000 Web posted at: 11:37 a.m. EST (1637 GMT) by Stephanie Sanborn

From...

(IDG) -- Microsoft has fixed a password-exposing flaw in Hotmail JavaScript filters. The security snafu allowed access to user account passwords by tricking users into re-entering their passwords in a false log-in window.

Using JavaScript commands through an HTML tag in an e-mail message, a fake password log-in display dialog box would pop up, causing unsuspecting users to re-enter their passwords, thinking there had been a log-in problem. Re-entering the password in the fake box would reveal it to the attacker who sent the message.

	QUICKVOTE
Do you use Hotmail? Yes No View Results
	MESSAGE BOARD
Microsoft

According to Bulgarian programmer Georgi Guninski, who discovered the hole, the Hotmail flaw could be used to fool those using Internet Explorer 4.x, 5.x, and Netscape Communicator 4.x.

Although Hotmail has filters to prevent these JavaScript breaches, the tag used to create the fake log-in window could get through or around those security filters.

"There is no risk associated with JavaScript applets in general, but they aren't appropriate in the particular case of Internet e-mail services like Hotmail," according to a statement from Microsoft. "In this case, the vulnerability provided a way to circumvent the restriction. Now that Microsoft has implemented a fix, this possibility no longer exists."

MORE COMPUTING INTELLIGENCE

IDG.net home page

Microsoft's statement added that there is no evidence suggesting any Hotmail users were affected, and the flaw has been fixed so that users need not disable their browsers' JavaScript options.