Signature Detail

HTTP: Outlook Express Address Book Overflow

This signature detects attempts to exploit a known vulnerability in Outlook Express when processing contacts in Windows Address Book (.WAB) file. Attackers sending a maliciously crafted .WAB file can persuade a user to execute this file, causing a buffer overflow; thus allowing arbitrary code execution in the logged-on user's contexts.

Extended Description

Microsoft Outlook Express is prone to a remote buffer-overflow vulnerability. This vulnerability presets itself when the application processes a specially crafted Windows Address Book (.wab) file. An attacker may exploit this issue to execute arbitrary code in the context of a user running the vulnerable application. This may result in a remote compromise.

Affected Products

• Microsoft Outlook Express 5.5
• Microsoft Outlook Express 5.5 SP1
• Microsoft Outlook Express 5.5 SP2
• Microsoft Outlook Express 6.0
• Microsoft Outlook Express 6.0 SP1

References

• BugTraq: 17459
• CVE: CVE-2006-0014
• URL: http://www.microsoft.com/technet/security/bulletin/MS06-016.mspx