PT-2005-5501 · Microsoft · Outlook Express+1

Publicado 2005-12-31 · Atualizado 2021-07-23 · CVE-2005-4840

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Outlook Express (affected versions not specified) Internet Explorer version 6

Description The issue allows remote attackers to cause a denial of service, resulting in a NULL dereference and browser crash. This occurs when the OutlookExpress.AddressBook COM object is created, which is not intended for use within Internet Explorer.

Recommendations For Internet Explorer version 6, avoid using the Outlook Express Address Book control to prevent the denial of service. As a temporary workaround, consider disabling the creation of the OutlookExpress.AddressBook COM object within Internet Explorer until a patch is available.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2005-4840

Produtos afetados

Internet Explorer

Outlook Express

Referências · 6

• http://securityfocus.com/archive/1/470694/100/0/threaded · Nota
• http://osvdb.org/26836 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34755 · Nota
• http://browserfun.blogspot.com/2006/07/mobb-3-outlookexpressaddressbook_02.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-4840 · Nota de Segurança
• http://securityfocus.com/archive/1/391803 · Nota