PT-2001-2231 · Microsoft · Outlook+1

Published 2001-06-05 · Updated 2017-10-10 · CVE-2001-1088

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Outlook versions 8.5 and earlier Microsoft Outlook Express versions 5 and earlier

Description The issue concerns a scenario where an untrusted remote attacker could potentially spoof legitimate addresses and intercept email. This is possible because the software does not notify the user when the Reply-To address differs from the From address, given that the "Automatically put people I reply to in my address book" option is enabled.

Recommendations For Microsoft Outlook versions 8.5 and earlier, disable the "Automatically put people I reply to in my address book" option to prevent address book modifications by potentially spoofed emails. For Microsoft Outlook Express versions 5 and earlier, disable the "Automatically put people I reply to in my address book" option to minimize the risk of intercepting emails intended for other users.

Exploit

Fix

Related Identifiers

CVE-2001-1088

Affected Products

Outlook

Outlook Express

References · 6

• 🔥 https://exploit-db.com/exploits/20899 · Exploit
• 🔥 http://securityfocus.com/bid/2823 · Exploit
• 🔥 http://securityfocus.com/archive/1/188752 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2001-1088 · Security Note
• http://support.microsoft.com/default.aspx?scid=kb%3BEN-US%3Bq234241 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/6655 · Note