PT-2004-1438 · Microsoft · Outlook+1

Sasa Kos · Published 2004-03-18 · Updated 2021-07-23 · CVE-2004-0284

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer version 6.0 Microsoft Outlook version 2002 Microsoft Outlook version 2003

Description The issue allows remote attackers to cause a denial of service, specifically CPU consumption, under certain conditions. This can be triggered by visiting a web site or opening an HTML e-mail that contains two null characters (%00) after the host name, provided that the "Do not save encrypted pages to disk" option is disabled.

Recommendations For Microsoft Internet Explorer version 6.0, enable the "Do not save encrypted pages to disk" option to prevent exploitation. For Microsoft Outlook version 2002, enable the "Do not save encrypted pages to disk" option to prevent exploitation. For Microsoft Outlook version 2003, enable the "Do not save encrypted pages to disk" option to prevent exploitation.

Fix

Related Identifiers

CVE-2004-0284

Affected Products

Internet Explorer

Outlook

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2004-0284 · Security Note
• http://securityfocus.com/bid/9629 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15127 · Note
• http://marc.info/?l=bugtraq&m=107643134712133&w=2 · Note