PT-2013-4730 · Microsoft · Outlook

Alexander Klink · Publicado 2013-11-12 · Atualizado 2021-08-30 · CVE-2013-3905

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Outlook versions 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT

Description The issue allows remote attackers to obtain sensitive network configuration and state information via a crafted certificate in an e-mail message. An attacker who successfully exploited this issue could ascertain system information, such as the IP address and open TCP ports, from the target system and other systems that share the network with the target system.

Recommendations For Microsoft Outlook versions 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT, at the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2013-3905

Produtos afetados

Outlook

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2013-3905 · Nota de Segurança
• http://technet.microsoft.com/en-us/security/bulletin/ms13-094 · Nota
• http://us-cert.gov/ncas/alerts/TA13-317A · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3905 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-094 · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19239 · Nota