PT-2018-1078 · Microsoft · Outlook

Nicolas Joly · Published 2018-01-09 · Updated 2019-10-03 · CVE-2018-0791

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Outlook versions 2007 through 2016

Description The issue is related to the way email messages are parsed, allowing a remote code execution. An attacker could exploit this by sending a specially crafted file, potentially taking control of an affected system, installing programs, viewing, changing, or deleting data, or creating new accounts with full user rights. Exploitation requires a user to open a specially crafted file with an affected version of Microsoft Outlook.

Recommendations For Microsoft Outlook versions 2007 through 2016, update to a version that includes the fix for this issue to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2018-00421

CVE-2018-0791

Affected Products

Outlook

References · 7

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0791 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-0791 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-0791 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0791 · Security Note
• https://bdu.fstec.ru/vul/2018-00421 · Security Note
• http://securityfocus.com/bid/102383 · Note
• http://securitytracker.com/id/1040154 · Note