PT-2002-1532 · Microsoft · Outlook+1

Publicado 2002-06-11 · Atualizado 2008-09-05 · CVE-2002-0481

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Windows Media Player versions (affected versions not specified) Outlook version 2002

Description The issue allows remote attackers to bypass security settings and execute Javascript. This is achieved through an interaction between Windows Media Player and Outlook, where an HTML email message references certain media files, such as .WMS files. The onload handlers of these files execute the player.LaunchURL() Javascript function, enabling the execution of Javascript code.

Recommendations For Windows Media Player, consider disabling the LaunchURL() function as a temporary workaround until a patch is available. For Outlook 2002, restrict the handling of HTML email messages that reference WMP media files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2002-0481

Produtos afetados

Outlook

Windows Media Player

Referências · 4

• http://iss.net/security_center/static/8604.php · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2002-0481 · Nota de Segurança
• http://online.securityfocus.com/archive/1/263429 · Aviso do Fabricante
• http://securityfocus.com/bid/4340 · Aviso do Fabricante