Microsoft Outlook / Microsoft Exchange TNEF Decoding Remote Code Execution Vulnerability

Bugtraq ID:	16197
Class:	Boundary Condition Error
CVE:	CVE-2006-0002
Remote:	Yes
Local:	No
Published:	Jan 10 2006 12:00AM
Updated:	Feb 07 2006 08:53PM
Credit:	Discovered by John Heasman and Marc Litchfield of NGS Software.
Vulnerable:	Nortel Networks Self-Service 0 Nortel Networks Passport Multiservice Data Manager (MDM) Nortel Networks Optivity Telephony Manager for SL-100 Microsoft Outlook 2003 0 + Microsoft Office 2003 SP3 + Microsoft Office 2003 SP3 + Microsoft Office 2003 SP2 + Microsoft Office 2003 SP2 + Microsoft Office 2003 SP1 + Microsoft Office 2003 SP1 + Microsoft Office 2003 0 + Microsoft Office 2003 0 Microsoft Outlook 2002 SP3 + Microsoft Office XP SP3 + Microsoft Office XP SP3 Microsoft Outlook 2000 SP3 + Microsoft Office 2000 SP3 + Microsoft Office 2000 SP3 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows 98SE - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows ME - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Home - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional - Microsoft Windows XP Professional - Microsoft Windows XP Professional Microsoft Office XP SP3 + Microsoft Excel 2002 SP3 + Microsoft Excel 2002 SP3 + Microsoft FrontPage 2002 SP3 + Microsoft FrontPage 2002 SP3 + Microsoft Outlook 2002 SP3 + Microsoft Outlook 2002 SP3 + Microsoft PowerPoint 2002 SP3 + Microsoft PowerPoint 2002 SP3 + Microsoft Publisher 2002 SP3 + Microsoft Publisher 2002 SP3 Microsoft Office 2003 SP2 Microsoft Office 2003 SP1 Microsoft Office 2000 SP3 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional Microsoft Exchange Server 2000 SP3 Microsoft Exchange Server 5.5 SP4 - Microsoft BackOffice 4.5 - Microsoft BackOffice 4.5 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 Microsoft Exchange Server 5.5 SP3 - Microsoft BackOffice 4.5 - Microsoft BackOffice 4.5 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 Microsoft Exchange Server 5.5 SP2 - Microsoft BackOffice 4.5 - Microsoft BackOffice 4.5 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 Microsoft Exchange Server 5.5 SP1 - Microsoft BackOffice 4.5 - Microsoft BackOffice 4.5 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 Microsoft Exchange Server 5.5 - Microsoft BackOffice 4.5 - Microsoft BackOffice 4.5 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 Microsoft Exchange Server 5.0 SP2 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 Microsoft Exchange Server 5.0 SP1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 Microsoft Exchange Server 5.0 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0
Not Vulnerable:

Microsoft Outlook / Microsoft Exchange TNEF Decoding Remote Code Execution Vulnerability

Microsoft Exchange Server and Outlook email clients are prone to a remote code-execution vulnerability.

This vulnerability presents itself when the applications decode a message containing a specially crafted TNEF MIME attachment. Successful exploitation may result in arbitrary code execution facilitating a remote compromise.

An attack against Microsoft Exchange Server could lead to a SYSTEM-level remote compromise, while attacks against Outlook would result in arbitrary code execution in the context of the current user.

Microsoft Outlook / Microsoft Exchange TNEF Decoding Remote Code Execution Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Microsoft Outlook / Microsoft Exchange TNEF Decoding Remote Code Execution Vulnerability

Solution:

Microsoft has released fixes for supported applications.

Nortel has released an advisory (2006006583) to identify vulnerable products. The vendor advises customers to follow Microsoft's recommendations and install fixes supplied by Microsoft.


Microsoft Exchange Server 5.0 SP2

• Microsoft Security Update for Exchange 5.0 Server (KB894689)
  http://www.microsoft.com/downloads/details.aspx?familyid=0A8DF1C3-ABF9 -4A21-9B49-81FA362B251F&displaylang=en

Microsoft Office XP SP3

• Microsoft Security Update for Office XP Multilingual User Interface Pack (KB892841)
  Fix for Microsoft Office XP Multilingual User Interface Packs.
  http://www.microsoft.com/downloads/details.aspx?familyid=CCA9399A-6DA3 -4163-8398-C58DC328182B&displaylang=en


• Microsoft Security Update for Outlook 2002 (KB892841)
  Fix for Microsoft Outlook 2002.
  http://www.microsoft.com/downloads/details.aspx?familyid=9A85CEBB-0D9A -465D-A4BC-AF501562772D&displaylang=en

Microsoft Office 2003 SP2

• Microsoft Office 2003 Service Pack 2 for Language Interface Pack
  Fix for Microsoft Office 2003 Language Interface Packs.
  http://www.microsoft.com/downloads/details.aspx?familyid=db080de8-8193 -4c32-9019-9980ecd6874a&displaylang=en


• Microsoft Security Update for Office 2003 Multilingual User Interface Pack (KB892843)
  Fix for Microsoft Office 2003 Multilingual User Interface Packs.
  http://www.microsoft.com/downloads/details.aspx?familyid=D69554AD-196F -4789-91E5-B2A753EED854&displaylang=en


• Microsoft Security Update for Outlook 2003 (KB892843)
  Fix for Microsoft Office Outlook 2003.
  http://www.microsoft.com/downloads/details.aspx?familyid=1D156043-B041 -4305-8442-3C4E3B832788&displaylang=en

Microsoft Office 2000 SP3

• Microsoft Security Update for Office 2000 Multilanguage Pack (KB892842)
  http://www.microsoft.com/downloads/details.aspx?familyid=2C0FA7C7-91AA -49B4-9731-9E83E3E0823D&displaylang=en


• Microsoft Security Update for Office 2000 Multilanguage Pack (KB892842)
  Fix for MultiLanguage Packs.
  http://www.microsoft.com/downloads/details.aspx?familyid=2C0FA7C7-91AA -49B4-9731-9E83E3E0823D&displaylang=en


• Microsoft Security Update for Outlook 2000 (KB892842)
  Fix for Microsoft Outlook 2000.
  http://www.microsoft.com/downloads/details.aspx?familyid=64D0336D-F962 -4AB1-A724-9F6BA2108CB9&displaylang=en

Microsoft Exchange Server 2000 SP3

• Microsoft Security Update for Exchange 2000 Server (KB894689)
  Fix for Microsoft Exchange 2000 Server Pack 3 with the Exchange 2000 Post-Service Pack 3 Update Rollup of August 2004.
  http://www.microsoft.com/downloads/details.aspx?familyid=372FF07F-C3CA -4301-8559-9B90344EDC02&displaylang=en

Microsoft Office 2003 SP1

• Microsoft Office 2003 Service Pack 2 for Language Interface Pack
  Fix for Microsoft Office 2003 Language Interface Packs.
  http://www.microsoft.com/downloads/details.aspx?familyid=db080de8-8193 -4c32-9019-9980ecd6874a&displaylang=en


• Microsoft Security Update for Office 2003 Multilingual User Interface Pack (KB892843)
  Fix for Microsoft Office 2003 Multilingual User Interface Packs.
  http://www.microsoft.com/downloads/details.aspx?familyid=D69554AD-196F -4789-91E5-B2A753EED854&displaylang=en


• Microsoft Security Update for Outlook 2003 (KB892843)
  Fix for Microsoft Office Outlook 2003.
  http://www.microsoft.com/downloads/details.aspx?familyid=1D156043-B041 -4305-8442-3C4E3B832788&displaylang=en

Microsoft Exchange Server 5.5 SP4

• Microsoft Security Update for Exchange Server 5.5 Service Pack 4 (KB894689)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=EC6BD30E-12DE -4CA1-9432-D2E73AF62427

Microsoft Outlook / Microsoft Exchange TNEF Decoding Remote Code Execution Vulnerability

References:

• 2006006583 - NORTEL RESPONSE TO MICROSOFT SECURITY BULLETIN MS06-003 (Nortel Networks)
  
• ASA-2006-004 - Windows Security Updates for January 2006 - (MS06-002 MS06-003) (Avaya)
  
• Microsoft Security Bulletin MS06-003 (Microsoft)
  
• Microsoft Exchange Critical Vulnerability ("NGSSoftware Insight Security Research" )
  
• Microsoft Outlook Critical Vulnerability ("NGSSoftware Insight Security Research" )