Re: Security related problems using the Outlook object model

From:

v-jzho@online.microsoft.com ("Ji Zhou [MSFT]")

Newsgroups:

microsoft.public.vc.language

Date:

Mon, 22 Sep 2008 06:51:29 GMT

Message-ID:

<dgLqn#HHJHA.6004@TK2MSFTNGHUB02.phx.gbl>

Hello Frank,

Sorry about not mentioning that the above code is only supposed to work in
Vista to detect the integrity level, because Vista introduce a new access
right PROCESS_QUERY_LIMITED_INFORMATION which can let normal right process
to query elevated privilege process.

In the XP, I don't think there is a exact way to detect if the Outlook is
now running with admin privilege from our application because our
application is running within normal privilege. Normal privilege process is
limited to access higher privilege process's information. This is by
designed for the security issues.

Thus, may I suggest the following approach as a workaround? In the XP, we
can iterate through all the processes to find out the outlook process, and
try to call OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, false,
outlookPID). If outlook is running with admin privilege, we will get an
Access Denied error there. If not, we can automate the Outlook in the XP
system. Code looks like:

void CtestDlg::OnBnClickedButton1()
{
   HANDLE hProcessSnap;
   HANDLE hProcess;
   PROCESSENTRY32 pe32;
   DWORD dwError = ERROR_SUCCESS;

   hProcessSnap = CreateToolhelp32Snapshot( TH32CS_SNAPPROCESS, 0 );
   pe32.dwSize = sizeof( PROCESSENTRY32 );
   Process32First( hProcessSnap, &pe32 );
   do
   {
      CString s(pe32.szExeFile,11);
      if(s == TEXT("OUTLOOK.EXE"))
      {
         hProcess = OpenProcess(PROCESS_QUERY_INFORMATION , false,
pe32.th32ProcessID);
         if(hProcess == 0)
         {
            dwError = GetLastError();
         }
         break;
      }
   }while(Process32Next( hProcessSnap, &pe32 ));

   if(dwError == ERROR_SUCCESS)
   {
      HRESULT hr = NULL;
      Outlook::_ApplicationPtr m_pApplication;
      hr = m_pApplication.CreateInstance(TEXT("Outlook.Application"));
      MessageBox(m_pApplication->Name);
   }
   else if(dwError == ERROR_ACCESS_DENIED)
   {
      MessageBox(TEXT("ACCESS DENIED! Outlook may be running in a higher
priviledge"));
   }
}

Please let me know whether this works for your scenario or not.

Best regards,
Ji Zhou (v-jzho@online.microsoft.com, remove 'online.')
Microsoft Online Community Support

Delighting our customers is our #1 priority. We welcome your comments and
suggestions about how we can improve the support we provide to you. Please
feel free to let my manager know what you think of the level of service
provided. You can send feedback directly to my manager at:
msdnmg@microsoft.com.

This posting is provided "AS IS" with no warranties, and confers no rights.