PT-2013-4730 · Microsoft · Outlook

Alexander Klink · Published 2013-11-12 · Updated 2021-08-30 · CVE-2013-3905

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Outlook versions 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT

Description The issue allows remote attackers to obtain sensitive network configuration and state information via a crafted certificate in an e-mail message. An attacker who successfully exploited this issue could ascertain system information, such as the IP address and open TCP ports, from the target system and other systems that share the network with the target system.

Recommendations For Microsoft Outlook versions 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT, at the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2013-3905

Affected Products

Outlook

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2013-3905 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3905 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-094 · Vendor Advisory
• http://technet.microsoft.com/en-us/security/bulletin/ms13-094 · Note
• http://us-cert.gov/ncas/alerts/TA13-317A · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19239 · Note