HTTP: Outlook Express Address Book Overflow

This signature detects attempts to exploit a known vulnerability in Outlook Express when processing contacts in Windows Address Book (.WAB) file. Attackers sending a maliciously crafted .WAB file can persuade a user to execute this file, causing a buffer overflow; thus allowing arbitrary code execution in the logged-on user's contexts.

Extended Description

Microsoft Outlook Express is prone to a remote buffer-overflow vulnerability. This vulnerability presets itself when the application processes a specially crafted Windows Address Book (.wab) file. An attacker may exploit this issue to execute arbitrary code in the context of a user running the vulnerable application. This may result in a remote compromise.

Affected Products

Microsoft outlook_express

References

BugTraq: 17459

CVE: CVE-2006-0014

URL: http://www.microsoft.com/technet/security/bulletin/MS06-016.mspx

Short Name

HTTP:STC:OUTLOOK:WAB-BOF

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Outlook Express Address Book Overflow

Extended Description

Affected Products

References

Found a potential security threat?