Security Hole Found In MSN MessengerSecurity Hole Found In MSN Messenger

Microsoft is urging users of its popular MSN Messenger software to update to the latest version because of a "critical" security vulnerability affecting the MSN Chat control commonly found in MSN Messenger 4.5 and 4.6 and Microsoft Exchange Instant Messenger 4.5 and 4.6.

MSN Chat control lets users create ad hoc chat rooms. The flaw is related to an unchecked buffer, which, if invoked a certain way, allows an attacker to run code on the victim's system. The buffer overflow can be exploited by E-mail, a maliciously configured Web page, or any time Internet Explorer displays HTML. The vulnerability was discovered by eEye Digital Security about a month ago and disclosed by Microsoft late Wednesday.

The fix is a simple upgrade, Microsoft says. The patch, along with more information, can be found at Microsoft's Web site.