Signature Detail

HTTP: Microsoft Outlook SMB ATTACH_BY_REFERENCE Code Execution

This signature detects attempts to exploit a known flaw in Microsoft Office Outlook Email client application. The vulnerability is due to a design error while Outlook parses specially crafted email attachments. Remote attackers can exploit this vulnerability by sending a crafted email attachment using the ATTACH_BY_REFERENCE method. Successful exploitation of this vulnerability would result in arbitrary code execution with the privileges of the logged on user.

Extended Description

Microsoft Outlook is prone to a remote code-execution vulnerability because it fails to properly verify attachments. Attackers can exploit this issue by enticing an unsuspecting user into opening a specially crafted email attachment. Successfully exploiting this issue will allow an attacker to execute arbitrary code with the privileges of the currently logged-in user. Failed exploit attempts will result in a denial-of-service condition.

Affected Products

• Microsoft Outlook 2002 SP1
• Microsoft Outlook 2002 SP2
• Microsoft Outlook 2002 SP3
• Microsoft Outlook 2002
• Microsoft Outlook 2003 SP2
• Microsoft Outlook 2003 SP3
• Microsoft Outlook 2003
• Microsoft Outlook 2007
• Microsoft Outlook 2007 SP1
• Microsoft Outlook 2007 SP2

References

• BugTraq: 41446
• CVE: CVE-2010-0266