Signature Detail

SMTP: MS-Outlook: Object Tag with XML Exploit

This signature detects attempts to exploit a known vulnerability in Microsoft Outlook and Outlook Express. Attackers can embed malicious object tags in a script included with an e-mail; due to a known vulnerability in handling object tags with XML data, Outlook and Outlook Express process the script when the e-mail appears in the preview pane (the e-mail does not need to be opened). A successful attack can allow arbitrary code execution with the current user permissions.

Extended Description

Internet Explorer does not properly handle object types, when rendering XML based web sites. This may result in the possibility of the execution of malicious software. The problem occurs when Internet Explorer receives a response from the server when a malicious XML web page containing an embedded object tag is parsed. Successful exploitation of this vulnerability could allow a malicious object to be trusted and as such be installed and executed on the local system. The Mindwarper exploit is actually reported to exploit one of the issues in BID 8577, which has not been addressed by the patches provided in MS03-040.

Affected Products

• Microsoft Internet Explorer 5.0.1
• Microsoft Internet Explorer 5.0.1 SP1
• Microsoft Internet Explorer 5.0.1 SP2
• Microsoft Internet Explorer 5.0.1 SP3
• Microsoft Internet Explorer 5.5
• Microsoft Internet Explorer 5.5 SP1
• Microsoft Internet Explorer 5.5 SP2
• Microsoft Internet Explorer 6.0
• Microsoft Internet Explorer 6.0 SP1

References

• BugTraq: 8565
• CVE: CVE-2003-0809
• URL: http://www.microsoft.com/technet/security/bulletin/MS03-040.mspx