Re: Security related problems using the Outlook object model

Hello Frank,

Thanks for using Microsoft Newsgroup Support Service, my name is Ji Zhou
[MSFT] and I will be working on this issue with you.

I can reproduce your issue. When I start Outlook with administrator
privilege and my application normally, the CreateInstance function fails
with en error says "server execution fail".

Finally, I use the following code to judge whether Outlook is running with
higher privilege than my application. I am posting the codes as follows and
will give an detailed explanation later.

int GetProcessIntergrityLevel(HANDLE p)
{
   HANDLE hToken;
   HANDLE hProcess;
   DWORD dwLengthNeeded;
   DWORD dwError = ERROR_SUCCESS;
   PTOKEN_MANDATORY_LABEL pTIL = NULL;
   LPWSTR pStringSid;
   DWORD dwIntegrityLevel;
 
   hProcess = p;
   if (OpenProcessToken(hProcess,
         TOKEN_QUERY | TOKEN_QUERY_SOURCE,
         &hToken))
   {
      if (!GetTokenInformation(hToken, TokenIntegrityLevel,
           NULL, 0, &dwLengthNeeded))
     {
        dwError = GetLastError();
        if (dwError == ERROR_INSUFFICIENT_BUFFER)
        {
           pTIL = (PTOKEN_MANDATORY_LABEL)LocalAlloc(0,
                  dwLengthNeeded);
           if (pTIL != NULL)
           {
              if (GetTokenInformation(hToken, TokenIntegrityLevel,
                 pTIL, dwLengthNeeded, &dwLengthNeeded))
             {
                dwIntegrityLevel = *GetSidSubAuthority(pTIL->Label.Sid,
                  
(DWORD)(UCHAR)(*GetSidSubAuthorityCount(pTIL->Label.Sid)-1));
                if (dwIntegrityLevel < SECURITY_MANDATORY_MEDIUM_RID)
                {
                   return 0;
                }
                else if (dwIntegrityLevel >= SECURITY_MANDATORY_MEDIUM_RID
&&
                     dwIntegrityLevel < SECURITY_MANDATORY_HIGH_RID)
                {
                   return 1;
                }
                else if (dwIntegrityLevel >= SECURITY_MANDATORY_HIGH_RID)
                {
                   return 2;
                }
             }
             LocalFree(pTIL);
          }
       }
    }
    CloseHandle(hToken);
 }
}

/////////////////////////////////////////////////////////
void CtestDlg::OnBnClickedButton1()
{
   int myApp = GetProcessIntergrityLevel(GetCurrentProcess());

   HANDLE hProcessSnap;
   HANDLE hProcess;
   PROCESSENTRY32 pe32;

   hProcessSnap = CreateToolhelp32Snapshot( TH32CS_SNAPPROCESS, 0 );
   pe32.dwSize = sizeof( PROCESSENTRY32 );
   Process32First( hProcessSnap, &pe32 );
   do
   {
      CString s(pe32.szExeFile,11);
      if(s == TEXT("OUTLOOK.EXE"))
      {
         hProcess = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION , false,
pe32.th32ProcessID);
    break;
      }
   }while(Process32Next( hProcessSnap, &pe32 ));

   int outlookApp = GetProcessIntergrityLevel(hProcess);

   if(myApp >= outlookApp)
   {
      MessageBox(TEXT("We can automate Outlook from our application"));
      HRESULT hr = NULL;
      Outlook::_ApplicationPtr m_pApplication;
      hr = m_pApplication.CreateInstance(TEXT("Outlook.Application"));
      MessageBox(m_pApplication->Name);
   }
   else
   {
      MessageBox(TEXT("Outlook is running with higher privilege than this
application"));
   }
}

In the above code, we create a function named GetProcessIntergrityLevel
which calls the Windows API OpenProcessToken, GetTokenInformation,
GetSidSubAuthority to get a given process's privilege level. And in a
button's click event handle, we use that function to get the Outlook and
our application's privilege level respectively for later comparing.

We use the tool helper library's Process32First and Process32Next to walk
through all opened process to find out the Outlook instance. Thus we need
to include the <tlhelp32.h> header file.

Please try my code and let me know if that works on your side. And if you
have any other questions, please feel free to post. I will try my best to
provide future help.

Best regards,
Ji Zhou (v-jzho@online.microsoft.com, remove 'online.')
Microsoft Online Community Support

Delighting our customers is our #1 priority. We welcome your comments and
suggestions about how we can improve the support we provide to you. Please
feel free to let my manager know what you think of the level of service
provided. You can send feedback directly to my manager at:
msdnmg@microsoft.com.

==================================================
Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/en-us/subscriptions/aa948868.aspx#notifications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at
http://support.microsoft.com/select/default.aspx?target=assistance&ln=en-us.
==================================================
This posting is provided "AS IS" with no warranties, and confers no rights.