PT-2003-2323 · Microsoft · Outlook 2000+1

Publicado 2003-12-31 · Atualizado 2017-07-29 · CVE-2003-1378

Positive Technologies (AI Summary)

CVSS v2.0

8.8

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Outlook Express version 6.0 Outlook 2000

Description The issue allows remote attackers to execute arbitrary programs via an HTML email. This is achieved by setting the CODEBASE parameter to the program in the email. The security zone must be set to Internet Zone for this to be possible.

Recommendations For Microsoft Outlook Express version 6.0, consider changing the security zone setting from Internet Zone to a more restrictive setting to minimize the risk of exploitation. For Outlook 2000, restrict the use of HTML emails until a fix is available.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2003-1378

Produtos afetados

Outlook Express

Outlook 2000

Referências · 6

• 🔥 https://exploit-db.com/exploits/22280 · Exploit
• 🔥 http://securityfocus.com/archive/1/312910 · Exploit
• 🔥 http://securityfocus.com/bid/6923 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2003-1378 · Nota de Segurança
• http://securityfocus.com/archive/1/312929 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11411 · Nota