Microsoft Outlook Express NNTP Response Parsing Buffer Overflow Vulnerability

Bugtraq ID:	13951
Class:	Boundary Condition Error
CVE:	CVE-2005-1213
Remote:	Yes
Local:	No
Published:	Jun 14 2005 12:00AM
Updated:	Nov 03 2007 01:16AM
Credit:	Reported by an anonymous source.
Vulnerable:	Microsoft Outlook Express 6.0 SP1 + Microsoft Windows XP 64-bit Edition SP1 + Microsoft Windows XP 64-bit Edition SP1 + Microsoft Windows XP Home SP1 + Microsoft Windows XP Home SP1 + Microsoft Windows XP Professional SP1 + Microsoft Windows XP Professional SP1 Microsoft Outlook Express 6.0 + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Itanium SP2 + Microsoft Windows Server 2003 Itanium SP2 + Microsoft Windows Server 2003 Itanium SP1 + Microsoft Windows Server 2003 Itanium SP1 + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Standard x64 Edition + Microsoft Windows Server 2003 Standard x64 Edition + Microsoft Windows Server 2003 Web Edition + Microsoft Windows Server 2003 Web Edition + Microsoft Windows Server 2003 Web Edition + Microsoft Windows Server 2003 x64 SP2 + Microsoft Windows Server 2003 x64 SP2 + Microsoft Windows XP 64-bit Edition + Microsoft Windows XP 64-bit Edition + Microsoft Windows XP Home + Microsoft Windows XP Home + Microsoft Windows XP Home + Microsoft Windows XP Media Center Edition SP2 + Microsoft Windows XP Media Center Edition SP2 + Microsoft Windows XP Media Center Edition + Microsoft Windows XP Media Center Edition + Microsoft Windows XP Media Center Edition + Microsoft Windows XP Professional + Microsoft Windows XP Professional + Microsoft Windows XP Professional + Microsoft Windows XP Professional x64 Edition SP2 + Microsoft Windows XP Professional x64 Edition SP2 + Microsoft Windows XP Tablet PC Edition SP2 + Microsoft Windows XP Tablet PC Edition SP2 + Microsoft Windows XP Tablet PC Edition + Microsoft Windows XP Tablet PC Edition Microsoft Outlook Express 5.5 SP2 + Microsoft Windows 2000 Advanced Server SP4 + Microsoft Windows 2000 Advanced Server SP4 + Microsoft Windows 2000 Advanced Server SP3 + Microsoft Windows 2000 Advanced Server SP3 + Microsoft Windows 2000 Datacenter Server SP4 + Microsoft Windows 2000 Datacenter Server SP4 + Microsoft Windows 2000 Datacenter Server SP3 + Microsoft Windows 2000 Datacenter Server SP3 + Microsoft Windows 2000 Professional SP4 + Microsoft Windows 2000 Professional SP4 + Microsoft Windows 2000 Professional SP3 + Microsoft Windows 2000 Professional SP3 + Microsoft Windows 2000 Server SP4 + Microsoft Windows 2000 Server SP4 + Microsoft Windows 2000 Server SP3 + Microsoft Windows 2000 Server SP3 + Microsoft Windows ME + Microsoft Windows ME Microsoft Outlook Express 5.5 SP1 Microsoft Outlook Express 5.5 + Microsoft Internet Explorer 5.0.1 for Windows NT 4.0 + Microsoft Internet Explorer 5.0.1 for Windows NT 4.0 + Microsoft Internet Explorer 5.0.1 for Windows 98 + Microsoft Internet Explorer 5.0.1 for Windows 98 + Microsoft Internet Explorer 5.0.1 for Windows 95 + Microsoft Internet Explorer 5.0.1 for Windows 95 + Microsoft Internet Explorer 5.0.1 for Windows 2000 + Microsoft Internet Explorer 5.0.1 for Windows 2000 + Microsoft Internet Explorer 5.0.1 + Microsoft Internet Explorer 5.0.1 + Microsoft Internet Explorer 5.5 + Microsoft Internet Explorer 5.5 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows 98SE - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 Microsoft Outlook Express 5.0
Not Vulnerable:

Microsoft Outlook Express NNTP Response Parsing Buffer Overflow Vulnerability

Microsoft Outlook Express is prone to a buffer overflow when parsing NNTP responses. Successful exploits could allow arbitrary code to run in the context of the user running the application.

Microsoft Outlook Express NNTP Response Parsing Buffer Overflow Vulnerability

eyas <[email protected]> provides the 'MS05-030-NNTP.c' exploit.

[email protected] provides the 'outlook_nntp.c' exploit.

A Metasploit framework exploit module is available.

UPDATE: Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

• /data/vulnerabilities/exploits/MS05-030-NNTP.c
• /data/vulnerabilities/exploits/outlook_nntp.c
• /data/vulnerabilities/exploits/ms05_030_nntp.pm

Microsoft Outlook Express NNTP Response Parsing Buffer Overflow Vulnerability

Solution:
Microsoft has released fixes for supported versions of the software.


Microsoft Outlook Express 5.5 SP1

• Microsoft Cumulative Security Update for Outlook Express 5.5 Service Pack 2 (KB897715)
  http://www.microsoft.com/downloads/details.aspx?familyid=a6932151-2ae2 -4c6e-861a-6ff5bde61191&displaylang=en

Microsoft Outlook Express 5.5

• Microsoft Cumulative Security Update for Outlook Express 5.5 Service Pack 2 (KB897715)
  http://www.microsoft.com/downloads/details.aspx?familyid=a6932151-2ae2 -4c6e-861a-6ff5bde61191&displaylang=en

Microsoft Outlook Express 5.5 SP2

• Microsoft Cumulative Security Update for Outlook Express 5.5 Service Pack 2 (KB897715)
  http://www.microsoft.com/downloads/details.aspx?familyid=a6932151-2ae2 -4c6e-861a-6ff5bde61191&displaylang=en

Microsoft Outlook Express 6.0 SP1

• Microsoft Cumulative Security Update for Outlook Express 5.5 Service Pack 2 (KB897715)
  http://www.microsoft.com/downloads/details.aspx?familyid=a6932151-2ae2 -4c6e-861a-6ff5bde61191&displaylang=en


• Microsoft Cumulative Security Update for Outlook Express 6 Service Pack 1 (KB897715)
  For Outlook Express 6.0 SP1 running on Windows XP SP1, Windows 2000 SP3, and Windows 2000 SP4.
  http://www.microsoft.com/downloads/details.aspx?familyid=89e4d8ee-4d8e -4660-a53d-28502b3d2518&displaylang=en


• Microsoft Cumulative Security Update for Outlook Express for Windows Server 2003 (KB897715)
  For Outlook Express 6.0 SP1 running on Windows Server 2003.
  http://www.microsoft.com/downloads/details.aspx?FamilyId=d439eee9-05eb -4ecb-9e86-6259f1acaabb&displaylang=en


• Microsoft Cumulative Security Update for Outlook Express for Windows Server 2003 64-bit Itanium Edition (KB897
  For Outlook Express 6.0 running on Windows Server 2003 64-bit Itanium Edition, Windows Server 2003, Datacenter Edition for 64-Bit Itanium-based Systems, and Windows Server 2003, Enterprise Edition for 64-Bit Itanium-based Systems.
  


• Microsoft Cumulative Security Update for Outlook Express for Windows XP 64-bit Itanium Edition (KB897715)
  For Outlook Express 6.0 SP1 running on Windows XP Professional 64-bit Edition SP1.
  


• Microsoft Cumulative Security Update for Outlook Express for Windows XP 64-bit Itanium Edition, Version 2003 (
  For Outlook Express 6.0 SP1 running on Windows XP for Itanium-based Systems Version 2003.
  

Microsoft Outlook Express 6.0

• Microsoft Cumulative Security Update for Outlook Express 5.5 Service Pack 2 (KB897715)
  http://www.microsoft.com/downloads/details.aspx?familyid=a6932151-2ae2 -4c6e-861a-6ff5bde61191&displaylang=en

Microsoft Outlook Express NNTP Response Parsing Buffer Overflow Vulnerability

References:

• iDEFENSE Security Advisory 06.14.05: Microsoft Outlook Express NNTP Response Par (iDEFENSE)
  
• Microsoft Security Bulletin MS05-030 (Microsoft)