PT-2004-3033 · Microsoft · Outlook Express

Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-2137

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Outlook Express version 6.0

Description The issue allows remote attackers to obtain sensitive information by leaking the BCC recipients of a message to the addresses listed in the To and CC fields when sending multipart e-mail messages using the "Break apart messages larger than" setting.

Recommendations For Outlook Express version 6.0, avoid using the "Break apart messages larger than" setting when sending emails with BCC recipients to prevent information leakage.

Fix

Related Identifiers

CVE-2004-2137

Affected Products

Outlook Express

References · 8

• http://secunia.com/advisories/12376 · Vendor Advisory
• http://support.microsoft.com/kb/843555 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-2137 · Security Note
• http://securitytracker.com/id?1011067 · Patch
• http://networksecurity.fi/advisories/outlook-bcc.html · Vendor Advisory
• http://securityfocus.com/bid/11040 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17098 · Note
• http://osvdb.org/9167 · Note