Email exploit detection software analyzes emails for exploits – i.e., it scans for methods used to exploit the OS, email client or Internet Explorer – that can permit execution of code or a program on the user’s system. An email exploit engine takes a different approach: it analyses the code for exploits that could be malicious.

The difference between a virus engine and an exploit engineĪnti-virus software is designed to detect known malicious code. Information on how to update the GFI MailSecurity exploits database and technical information about the exploit are available at. Users of GFI MailSecurity for Exchange/SMTP – GFI’s email content checking, exploit detection, threats analysis and anti-virus solution – simply need to download the latest exploit engine updates to allow GFI MailSecurity to detect any new viruses that use this exploit to propagate and infect systems.

New viruses based on this exploit can be caught by GFI’s gateway-level exploit engine This means that the attacker could execute code on the local disk of unpatched machines and/or access user files. The payload of such an attack could include running JavaScript under the My Computer (local) Security Zone. To exploit this vulnerability, attackers could simply create an HTML email that either lures the recipient into clicking a link in the message body or that contains a fake image that can automatically launch a link without requiring user intervention. The vulnerability is related to the way mailto URLs are handled and could allow Internet Explorer to execute code on affected machines. The new Outlook vulnerability, MS04-009, was yesterday upgraded to “high risk” by Microsoft Corp., which issued a patch against it on Tuesday (more details at ). London, UK, 11 March 2004 – GFI released an update to its email exploit engine today which can detect any viruses that exploit a newly discovered Outlook 2002 vulnerability.

GFI MailEssentials AV Scan Engine