Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

My IT department have disabled the opening of iCal/ics/web calendars in Outlook 2007, citing "Security Risks" as the reason, but I've not found anyone who's willing to let me know what those security risks are.

Is anyone here aware of any reasons why this is so and the possible resolutions?

B.

share|improve this question

migrated from stackoverflow.com Nov 22 '11 at 3:26

This question came from our site for professional and enthusiast programmers.

    
So you are running outlook and probably internet explorer under Windows, and you are worried about security risk of ical? Your must be joking. –  Rook Nov 21 '11 at 15:18
    
I have no choice over the software my organisation uses. If it helps makes you feel more smug, we're still on Windows XP. –  oharab Nov 22 '11 at 20:36
add comment

2 Answers

up vote 0 down vote accepted

Anywhere you allow someone to load data that isn't under their control or their IT department's control, you increase the risk that the data is under an attacker's control. If there's some flaw (known to Microsoft or otherwise) in the way Outlook parses .ics data, it could be used by an attacker who gets a user to open a malicious .ics file.

I'm not saying it's a trade-off that's worth making, just that this is the input that would've gone into the decision.

share|improve this answer
    
I guess it's fear of unknown flaws that is the answer. I hadn't considered them. –  oharab Nov 22 '11 at 20:37
add comment

There's some very old code execution vulnerabilities, but there are patches available for all of them:

http://www.iss.net/threats/249.html

http://technet.microsoft.com/en-us/security/bulletin/ms07-003

http://technet.microsoft.com/en-us/security/bulletin/ms07-026

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.