PT-2004-1312 · Microsoft · Outlook

CVE-2004-0121 · Publicado 2004-04-15 · Atualizado 2024-02-13

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Outlook version 2002

Description The issue concerns an argument injection vulnerability where Microsoft Outlook 2002 does not sufficiently filter parameters of mailto: URLs when using them as arguments when calling OUTLOOK.EXE. This allows remote attackers to use script code in the Local Machine zone and execute arbitrary programs.

Recommendations For Microsoft Outlook version 2002, as a temporary workaround, consider restricting the use of mailto: URLs until a patch is available. Avoid using script code in the Local Machine zone to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Argument Injection

Enumeração de Fraquezas

CWE-88

Identificadores relacionados

CVE-2004-0121

Produtos afetados

Outlook

Referências · 13

• 🔥 https://exploit-db.com/exploits/23796 · Exploit
• 🔥 http://securityfocus.com/bid/9827 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15429 · Nota
• http://idefense.com/application/poi/display?id=79&type=vulnerabilities · Aviso do Fabricante
• http://us-cert.gov/cas/techalerts/TA04-070A.html · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-009 · Aviso do Fabricante
• http://ciac.org/ciac/bulletins/o-096.shtml · Nota
• http://kb.cert.org/vuls/id/305206 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15414 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-0121 · Nota de Segurança
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A843 · Nota
• http://marc.info/?l=bugtraq&m=107893704602842&w=2 · Nota
• https://t.me/cvenotify/71280 · Publicação no Telegram