SMTP: Outlook VML Overflow

This signature detects attempts to exploit a known vulnerability in Microsoft Outlook. A successful attack can lead to a buffer overflow and arbitrary remote code execution within the context of the application.

Extended Description

Microsoft Internet Explorer is prone to a buffer-overflow vulnerability that arises because of an error in the processing of Vector Markup Language documents. An attacker can exploit this issue to execute arbitrary code within the context of the affected application. The method currently used to exploit this issue will typically terminate Internet Explorer. This vulnerability is currently being exploited in the wild as 'Trojan.Vimalov'. This vulnerability affects Internet Explorer version 6.0 on a fully patched system. Previous versions may also be affected. Update: Microsoft Outlook 2003 is also an attack vector for this issue, since it uses Internet Explorer to render HTML email. Reportedly, attacks are possible even when active scripting has been disabled for email viewing.

Affected Products

Avaya s8100_media_servers,Microsoft windows_xp_media_center_edition

References

BugTraq: 20096

CVE: CVE-2006-3866

URL: http://www.microsoft.com/technet/security/advisory/925568.mspx http://sunbeltblog.blogspot.com/2006/09/seen-in-wild-zero-day-exploit-being.html http://www.microsoft.com/technet/security/Bulletin/MS06-055.mspx

Short Name

SMTP:OUTLOOK:VML-BOF

Severity

Minor

Recommended

False

Recommended Action

None

SMTP: Outlook VML Overflow

Extended Description

Affected Products

References

Found a potential security threat?