PT-2001-2231 · Microsoft · Outlook+1

Publicado 2001-06-05 · Atualizado 2017-10-10 · CVE-2001-1088

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Outlook versions 8.5 and earlier Microsoft Outlook Express versions 5 and earlier

Description The issue concerns a scenario where an untrusted remote attacker could potentially spoof legitimate addresses and intercept email. This is possible because the software does not notify the user when the Reply-To address differs from the From address, given that the "Automatically put people I reply to in my address book" option is enabled.

Recommendations For Microsoft Outlook versions 8.5 and earlier, disable the "Automatically put people I reply to in my address book" option to prevent address book modifications by potentially spoofed emails. For Microsoft Outlook Express versions 5 and earlier, disable the "Automatically put people I reply to in my address book" option to minimize the risk of intercepting emails intended for other users.

Exploit

Correção

Identificadores relacionados

CVE-2001-1088

Produtos afetados

Outlook

Outlook Express

Referências · 6

• 🔥 https://exploit-db.com/exploits/20899 · Exploit
• 🔥 http://securityfocus.com/bid/2823 · Exploit
• 🔥 http://securityfocus.com/archive/1/188752 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2001-1088 · Nota de Segurança
• http://support.microsoft.com/default.aspx?scid=kb%3BEN-US%3Bq234241 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/6655 · Nota