Microsoft Outlook Express Multiple Vulnerabilities

Bugtraq ID:	14225
Class:	Unknown
CVE:	CVE-2005-2226
Remote:	Yes
Local:	No
Published:	Jul 12 2005 12:00AM
Updated:	Jul 12 2009 04:06PM
Credit:	Discovery is credited to Juha-Matti Laurio <[email protected]>.
Vulnerable:	Microsoft Outlook Express 6.0 SP2 Microsoft Outlook Express 6.0 SP1 + Microsoft Windows XP 64-bit Edition SP1 + Microsoft Windows XP 64-bit Edition SP1 + Microsoft Windows XP Home SP1 + Microsoft Windows XP Home SP1 + Microsoft Windows XP Professional SP1 + Microsoft Windows XP Professional SP1 Microsoft Outlook Express 6.0 + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Itanium SP2 + Microsoft Windows Server 2003 Itanium SP2 + Microsoft Windows Server 2003 Itanium SP1 + Microsoft Windows Server 2003 Itanium SP1 + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Standard x64 Edition + Microsoft Windows Server 2003 Standard x64 Edition + Microsoft Windows Server 2003 Web Edition + Microsoft Windows Server 2003 Web Edition + Microsoft Windows Server 2003 Web Edition + Microsoft Windows Server 2003 x64 SP2 + Microsoft Windows Server 2003 x64 SP2 + Microsoft Windows XP 64-bit Edition + Microsoft Windows XP 64-bit Edition + Microsoft Windows XP Home + Microsoft Windows XP Home + Microsoft Windows XP Home + Microsoft Windows XP Media Center Edition SP2 + Microsoft Windows XP Media Center Edition SP2 + Microsoft Windows XP Media Center Edition + Microsoft Windows XP Media Center Edition + Microsoft Windows XP Media Center Edition + Microsoft Windows XP Professional + Microsoft Windows XP Professional + Microsoft Windows XP Professional + Microsoft Windows XP Professional x64 Edition SP2 + Microsoft Windows XP Professional x64 Edition SP2 + Microsoft Windows XP Tablet PC Edition SP2 + Microsoft Windows XP Tablet PC Edition SP2 + Microsoft Windows XP Tablet PC Edition + Microsoft Windows XP Tablet PC Edition
Not Vulnerable:

Microsoft Outlook Express Multiple Vulnerabilities

Microsoft has released an update to address various issues affecting Outlook Express 6.0 running on Windows XP. These issues may allow remote attackers to cause the client to crash or disclose sensitive information.

Reportedly remote attackers may cause the client to crash by sending specially crafted email messages.

Another issue allows the default news server account to be displayed when a user replies to 'watched' conversation threads from multiple computers.

This BID will be updated when more details become available.

Microsoft Outlook Express Multiple Vulnerabilities

Some of these issues do not require an exploit. Others may require exploit code for successful attacks.

Currently we are not aware of any exploits for some of these issues. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Microsoft Outlook Express Multiple Vulnerabilities

Solution:
Microsoft has released an update to address this issue in Outlook Express 6.0 running on Microsoft Windows XP SP2.


Microsoft Outlook Express 6.0 SP2

• Microsoft Update for Windows XP (KB900930)
  http://www.microsoft.com/downloads/details.aspx?familyid=6BD9D050-DC56 -47BC-9112-023E11C61F9D&displaylang=en

Microsoft Outlook Express Multiple Vulnerabilities

References:

• Knowledge Base Article - 900930 (Microsoft)