PT-2005-2227 · Microsoft · Outlook Express

Publicado 2005-06-14 · Atualizado 2018-10-12 · CVE-2005-1213

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Outlook Express versions 5.5 SP2 through 6 SP1

Description A stack-based buffer overflow issue exists in the news reader component of Microsoft Outlook Express, allowing remote malicious NNTP servers to execute arbitrary code. This can be achieved by sending a LIST response with a long second field.

Recommendations For versions 5.5 SP2 through 6 SP1, consider disabling the news reader functionality until a patch is available. Restrict access to potentially malicious NNTP servers to minimize the risk of exploitation. Avoid using the affected news reader component in Microsoft Outlook Express until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2005-1213

Produtos afetados

Outlook Express

Referências · 12

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/nntp/ms05_030_nntp.rb · Exploit
• 🔥 https://exploit-db.com/exploits/16379 · Exploit
• 🔥 https://exploit-db.com/exploits/1066 · Exploit
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1088 · Nota
• http://idefense.com/application/poi/display?id=263&type=vulnerabilities · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A989 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-1213 · Nota de Segurança
• http://securitytracker.com/id?1014200 · Nota
• http://securityfocus.com/bid/13951 · Nota
• http://kb.cert.org/vuls/id/130614 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-030 · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A167 · Nota