Microsoft Outlook Express BCC Field Information Disclosure Vulnerability

Bugtraq ID:	11040
Class:	Design Error
CVE:	CVE-2004-2137
Remote:	Yes
Local:	No
Published:	Aug 25 2004 12:00AM
Updated:	Jul 12 2009 06:17AM
Credit:	This issue was discovered by Juha-Matti Laurio.
Vulnerable:	Microsoft Outlook Express 6.0 SP1 + Microsoft Windows XP 64-bit Edition SP1 + Microsoft Windows XP 64-bit Edition SP1 + Microsoft Windows XP Home SP1 + Microsoft Windows XP Home SP1 + Microsoft Windows XP Professional SP1 + Microsoft Windows XP Professional SP1 Microsoft Outlook Express 6.0 + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Itanium SP2 + Microsoft Windows Server 2003 Itanium SP2 + Microsoft Windows Server 2003 Itanium SP1 + Microsoft Windows Server 2003 Itanium SP1 + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Standard x64 Edition + Microsoft Windows Server 2003 Standard x64 Edition + Microsoft Windows Server 2003 Web Edition + Microsoft Windows Server 2003 Web Edition + Microsoft Windows Server 2003 Web Edition + Microsoft Windows Server 2003 x64 SP2 + Microsoft Windows Server 2003 x64 SP2 + Microsoft Windows XP 64-bit Edition + Microsoft Windows XP 64-bit Edition + Microsoft Windows XP Home + Microsoft Windows XP Home + Microsoft Windows XP Home + Microsoft Windows XP Media Center Edition SP2 + Microsoft Windows XP Media Center Edition SP2 + Microsoft Windows XP Media Center Edition + Microsoft Windows XP Media Center Edition + Microsoft Windows XP Media Center Edition + Microsoft Windows XP Professional + Microsoft Windows XP Professional + Microsoft Windows XP Professional + Microsoft Windows XP Professional x64 Edition SP2 + Microsoft Windows XP Professional x64 Edition SP2 + Microsoft Windows XP Tablet PC Edition SP2 + Microsoft Windows XP Tablet PC Edition SP2 + Microsoft Windows XP Tablet PC Edition + Microsoft Windows XP Tablet PC Edition
Not Vulnerable:

Microsoft Outlook Express BCC Field Information Disclosure Vulnerability

Microsoft Outlook Express is reported prone to a BCC field information disclosure vulnerability. It is reported that Outlook Express does not properly handle BCC headers, disclosing the email address on the blind carbon copy list to the 'To:' and 'CC:' field recipients of such a message. It is also reported that this issue only occurs if Outlook Express is configured to break messages into larger than a specific size.

This issue affects Microsoft Outlook Express 6.0.

Microsoft Outlook Express BCC Field Information Disclosure Vulnerability

No exploit is required.

Microsoft Outlook Express BCC Field Information Disclosure Vulnerability

Solution:
Microsoft has released a Knowledge Base Article (843555) with information about a hotfix to address this issue. Please see the article in web references for more information.

Microsoft has also released a Knowledge Base Artice (KB887797) to address this issue. Please see the article in the web references for more information.

Microsoft Outlook Express BCC Field Information Disclosure Vulnerability

References:

• Knowledge Base Article - 843555 (Microsoft)
  
• Knowledge Base Article - 887797 (Microsoft)