HTTP: Microsoft Outlook SMB ATTACH_BY_REFERENCE Code Execution

This signature detects attempts to exploit a known flaw in Microsoft Office Outlook Email client application. The vulnerability is due to a design error while Outlook parses specially crafted email attachments. Remote attackers can exploit this vulnerability by sending a crafted email attachment using the ATTACH_BY_REFERENCE method. Successful exploitation of this vulnerability would result in arbitrary code execution with the privileges of the logged on user.

Extended Description

Microsoft Outlook is prone to a remote code-execution vulnerability because it fails to properly verify attachments. Attackers can exploit this issue by enticing an unsuspecting user into opening a specially crafted email attachment. Successfully exploiting this issue will allow an attacker to execute arbitrary code with the privileges of the currently logged-in user. Failed exploit attempts will result in a denial-of-service condition.

Affected Products

Microsoft outlook_2003

References

BugTraq: 41446

CVE: CVE-2010-0266

Short Name

HTTP:STC:DL:OUTLOOK-CE

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Microsoft Outlook SMB ATTACH_BY_REFERENCE Code Execution

Extended Description

Affected Products

References

Found a potential security threat?