PT-2004-1312 · Microsoft · Outlook

Published 2004-04-15 · Updated 2024-02-13 · CVE-2004-0121

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Outlook version 2002

Description The issue concerns an argument injection vulnerability where Microsoft Outlook 2002 does not sufficiently filter parameters of mailto: URLs when using them as arguments when calling OUTLOOK.EXE. This allows remote attackers to use script code in the Local Machine zone and execute arbitrary programs.

Recommendations For Microsoft Outlook version 2002, as a temporary workaround, consider restricting the use of mailto: URLs until a patch is available. Avoid using script code in the Local Machine zone to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

CVE-2004-0121

Affected Products

Outlook

References · 13

• 🔥 https://exploit-db.com/exploits/23796 · Exploit
• 🔥 http://securityfocus.com/bid/9827 · Exploit
• http://idefense.com/application/poi/display?id=79&type=vulnerabilities · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-009 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0121 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15429 · Note
• http://us-cert.gov/cas/techalerts/TA04-070A.html · Note
• http://ciac.org/ciac/bulletins/o-096.shtml · Note
• http://kb.cert.org/vuls/id/305206 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15414 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A843 · Note
• http://marc.info/?l=bugtraq&m=107893704602842&w=2 · Note
• https://t.me/cvenotify/71280 · Telegram Post