PT-2013-4703 · Microsoft · Outlook

Publicado 2013-09-11 · Atualizado 2018-10-12 · CVE-2013-3870

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Outlook versions 2007 SP3, 2010 SP1, 2010 SP2

Description A remote code execution issue exists due to the way Microsoft Outlook handles specially crafted S/MIME email messages. This allows attackers to execute arbitrary code by including many nested S/MIME certificates in an email message. An attacker who successfully exploits this issue could take complete control of an affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Microsoft Outlook 2007 SP3, update to a version that is not affected by this issue. For Microsoft Outlook 2010 SP1, update to a version that is not affected by this issue. For Microsoft Outlook 2010 SP2, update to a version that is not affected by this issue.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2013-3870

Produtos afetados

Outlook

Referências · 8

• 🔥 http://blogs.technet.com/b/srd/archive/2013/09/10/ms13-068-a-difficult-to-exploit-double-free-in-outlook.aspx · Exploit
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18857 · Nota
• http://technet.microsoft.com/en-us/security/bulletin/ms13-068 · Nota
• http://blogs.technet.com/b/srd/archive/2013/09/10/assessing-risk-for-the-september-2013-security-updates.aspx · Aviso do Fabricante
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-068 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3870 · Nota de Segurança
• http://us-cert.gov/ncas/alerts/TA13-253A · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-3870 · Nota de Segurança