Microsoft Outlook 2003 Media File Script Execution Vulnerability

Bugtraq ID:	10369
Class:	Design Error
CVE:	CVE-2004-0503
Remote:	Yes
Local:	No
Published:	May 17 2004 12:00AM
Updated:	Jul 12 2009 05:16AM
Credit:	This issue has been disclosed by "[email protected]" <[email protected]>.
Vulnerable:	Microsoft Outlook 2003 0 + Microsoft Office 2003 SP3 + Microsoft Office 2003 SP3 + Microsoft Office 2003 SP2 + Microsoft Office 2003 SP2 + Microsoft Office 2003 SP1 + Microsoft Office 2003 SP1 + Microsoft Office 2003 0 + Microsoft Office 2003 0
Not Vulnerable:

Microsoft Outlook 2003 Media File Script Execution Vulnerability

Microsoft Outlook is reportedly prone to a media file script execution vulnerability. This issue is due to a design error that would allow for the execution of scripts located in media files regardless of security settings.

This issue might allow an attacker to execute arbitrary files on the affected computer. Leveraging other issues, such as the Microsoft Outlook 2003 Predictable File Location Weakness (BID 10307), it might be possible for an attacker to execute arbitrary, attacker-supplied code.

Microsoft Outlook 2003 Media File Script Execution Vulnerability

An exploit has been provided. The following message file is reported to be sufficient to leverage this issue:

http://www.malware.com/rockIT.zip

Microsoft Outlook 2003 Media File Script Execution Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Microsoft Outlook 2003 Media File Script Execution Vulnerability

References:

• ROCKET SCIENCE: Outllook 2003 ("[email protected]" <[email protected]>)