Signature Detail

SMTP: Microsoft Outlook Email Parsing Remote Code Execution

This signature detects attempts to exploit a known vulnerability against Microsoft Outlook. A successful attack can lead to arbitrary code execution.

Extended Description

Microsoft Outlook is prone to a remote heap-based buffer-overflow vulnerability because it fails to properly validate user-supplied data. Attackers can exploit this issue by enticing an unsuspecting user to preview or view a crafted email message. Successfully exploiting this issue will allow an attacker to execute arbitrary code with the privileges of the currently logged-in user. Failed exploit attempts will result in a denial-of-service condition.

Affected Products

• Microsoft Outlook 2002 SP1
• Microsoft Outlook 2002 SP2
• Microsoft Outlook 2002 SP3
• Microsoft Outlook 2002
• Microsoft Outlook 2003 SP2
• Microsoft Outlook 2003 SP3
• Microsoft Outlook 2003
• Microsoft Outlook 2007
• Microsoft Outlook 2007 SP1
• Microsoft Outlook 2007 SP2

References

• BugTraq: 43063
• CVE: CVE-2010-2728
• URL: http://www.microsoft.com/technet/security/bulletin/MS10-064.mspx