PT-2002-1532 · Microsoft · Outlook+1

Published 2002-06-11 · Updated 2008-09-05 · CVE-2002-0481

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Windows Media Player versions (affected versions not specified) Outlook version 2002

Description The issue allows remote attackers to bypass security settings and execute Javascript. This is achieved through an interaction between Windows Media Player and Outlook, where an HTML email message references certain media files, such as .WMS files. The onload handlers of these files execute the player.LaunchURL() Javascript function, enabling the execution of Javascript code.

Recommendations For Windows Media Player, consider disabling the LaunchURL() function as a temporary workaround until a patch is available. For Outlook 2002, restrict the handling of HTML email messages that reference WMP media files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2002-0481

Affected Products

Outlook

Windows Media Player

References · 4

• http://iss.net/security_center/static/8604.php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0481 · Security Note
• http://online.securityfocus.com/archive/1/263429 · Vendor Advisory
• http://securityfocus.com/bid/4340 · Vendor Advisory