A widely used plug-in for Microsoft's Outlook e-mail client that lets users encrypt and digitally sign messages has inadvertently weakened security and left the mail program open to attack.
Security company eEye Digital Security issued a warning late Wednesday to users of Network Associates' Pretty Good Privacy (PGP) plug-in for Outlook, saying that a vulnerability in the add-on could let attackers execute malicious software on a victim's computer. Network Associates released a patch for the problem Wednesday as well.
The irony of the flaw--it affects the most security conscious of computer users--did not escape Marc Maiffret, chief hacking officer for eEye.
"PGP is such a trusted product," Maiffret said. "It's a product made specifically to stop attackers from accessing your data, and here it is not only not stopping them but making it easier to get in."
You can download the patch here.
|