Microsoft Outlook Critical Vulnerability

Published
Credit
Risk
2006.01.12
John Heasman and Mark Litchfield
High
CWE
CVE
Local
Remote
CWE-noinfo
CVE-2006-0002
Yes
Yes

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial

John Heasman and Mark Litchfield of NGSSoftware have discovered a critical
vulnerability
affecting Microsoft Outlook. The vulnerable versions include:

Microsoft Outlook 2000 (inc. Microsoft Office 2000 Service Pack 3 and
Multilanguage packs)
Microsoft Outlook 2002 (inc. Microsoft Office XP Service Pack 3 and
Multilingual UI packs)
Microsoft Outlook 2003 (inc. Microsoft Office 2003 Service Pack 1, Service
Pack 2 and
Multilingual UI packs)

The vulnerability potentially allows execution of arbitrary code when the
user previews
or opens a specially crafted email message.

The flaw has now been addressed and patches are available from:

http://www.microsoft.com/technet/security/Bulletin/MS06-003.mspx

NGSSoftware are going to withhold details of this flaw for three months.
Full details will
be published on the 10th April 2006. This three month window will allow
system
administrators the time needed to obtain the patch before the details are
released to the
general public. This reflects NGSSoftware's approach to responsible
disclosure.

http://www.ngssoftware.com/disclosure.pdf

NGSSoftware Insight Security Research
http://www.ngssoftware.com
http://www.databasesecurity.com/
http://www.nextgenss.com/
+44(0)208 401 0070

Mark Litchfield
www.ngssoftware.com
Tel: +44 208 40 100 70
Fax: +44 208 40 100 76
Cell: +1 253 414 4749

--

The information contained in this email and any subsequent correspondence is
private, is solely for the intended recipient(s) and may contain
confidential or privileged information. For those other than the intended
recipient(s), any disclosure, copying, distribution, or any other action
taken, or omitted to be taken, in reliance on such information is prohibited
and may be unlawful. If you are not the intended recipient and have received
this message in error, please inform the sender and delete this mail and any
attachments.

The views expressed in this email do not necessarily reflect NGS policy. NGS
accepts no liability or responsibility for any onward transmission or use of
emails and attachments having left the NGS domain.


See this note in RAW Version

 
Bugtraq RSS
Bugtraq
 
CVE RSS
CVEMAP
 
REDDIT
REDDIT
 
DIGG
DIGG
 
LinkedIn
LinkedIn


Copyright 2017, cxsecurity.com