HTTP: Outlook Local File Execution

This signature detects a malicious link contained in a HTML document. Microsoft Outlook 2003 is vulnerable; other Outlook versions can also be affected. Attackers can embed a maliciously crafted link in an HTML document; when the HTML document is viewed, the link executes a file in the local user profile directory.

Extended Description

Microsoft Outlook and Outlook Express are reported to be prone to store various files, which may contain attacker-supplied content, in predictable locations. This may present a security risk because many known (and potential) Internet Explorer vulnerabilities depend on the attacker being able to directly reference malicious content on a victim system. Given both the ability to place such content on the file system and reference it specifically by location, exploitation of many browser-based vulnerabilities becomes possible. Other securiy consequences also exist, such as disclosure of Address Book contents.

Affected Products

Microsoft outlook_express

References

BugTraq: 9709

URL: http://www.security.nnov.ru/search/document.asp?docid=6184

Short Name

HTTP:STC:OUTLOOK:SHELL-PROFILE

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Outlook Local File Execution

Extended Description

Affected Products

References

Found a potential security threat?