PT-2010-2543 · Microsoft · Windows Live Mail+2
Francis Provencher
·
Published
2010-05-12
·
Updated
2023-12-07
·
CVE-2010-0816
CVSS v2.0
9.3
High
| Vector | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Microsoft Outlook Express versions 5.5 SP2, 6, and 6 SP1
Windows Live Mail on Windows XP SP2 and SP3, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7
Windows Mail on Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7
Description
The issue allows remote e-mail servers and man-in-the-middle attackers to execute arbitrary code via a crafted POP3 or IMAP response. This can be demonstrated by a certain +OK response on TCP port 110.
Recommendations
For Microsoft Outlook Express versions 5.5 SP2, 6, and 6 SP1, update to a newer version to mitigate the risk.
For Windows Live Mail on Windows XP SP2 and SP3, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7, update to a newer version to mitigate the risk.
For Windows Mail on Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7, update to a newer version to mitigate the risk.
As a temporary workaround, consider restricting access to the
inetcomm.dll module until a patch is available.
Avoid using the vulnerable POP3 and IMAP protocols in the affected email clients until the issue is resolved.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Outlook Express
Windows Live Mail
Windows Mail