Microsoft Outlook 2003 Predictable File Location Weakness

Bugtraq ID:	10307
Class:	Design Error
CVE:	CVE-2004-0502
Remote:	Yes
Local:	No
Published:	May 10 2004 12:00AM
Updated:	Jul 12 2009 04:07AM
Credit:	Discovery of this issue is credited to "[email protected]" <[email protected]>.
Vulnerable:	Microsoft Outlook 2003 0 + Microsoft Office 2003 SP3 + Microsoft Office 2003 SP3 + Microsoft Office 2003 SP2 + Microsoft Office 2003 SP2 + Microsoft Office 2003 SP1 + Microsoft Office 2003 SP1 + Microsoft Office 2003 0 + Microsoft Office 2003 0
Not Vulnerable:

Microsoft Outlook 2003 Predictable File Location Weakness

Microsoft Outlook 2003 is reported to be prone to store files that are specified in img tags, in predictable locations.

This may present a security risk because many known (and potential) Internet Explorer vulnerabilities depend on the attacker being able to directly reference malicious content on a victim system. Given both the ability to place such content on the file system and reference it specifically by location, exploitation of many browser-based vulnerabilities becomes possible.

Microsoft Outlook 2003 Predictable File Location Weakness

The following example has been supplied:

<img src="malware.htm" style="display:none">

Microsoft Outlook 2003 Predictable File Location Weakness

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Unconfirmed reports suggest that this issue may have been silently patched by Microsoft. These fixes may have been included in Office updates from May 14th or May 17th, 2004. See the References section for details.

Microsoft Outlook 2003 Predictable File Location Weakness

References:

• RE: PING: Outlook 2003 Spam ([email protected] <[email protected]>)