BID:3334

Microsoft Outlook Express 6 Plain Text Message Script Execution Vulnerability

Info

Microsoft Outlook Express 6 Plain Text Message Script Execution Vulnerability

Bugtraq ID:	3334
Class:	Unknown
CVE:	CVE-2001-0999
Remote:	Yes
Local:	No
Published:	Sep 12 2001 12:00AM
Updated:	Jul 11 2009 07:56AM
Credit:	This vulnerability was posted to BugTraq by [email protected] <[email protected]>.
Vulnerable:	Microsoft Outlook Express 6.0 + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Itanium SP2 + Microsoft Windows Server 2003 Itanium SP2 + Microsoft Windows Server 2003 Itanium SP1 + Microsoft Windows Server 2003 Itanium SP1 + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Standard x64 Edition + Microsoft Windows Server 2003 Standard x64 Edition + Microsoft Windows Server 2003 Web Edition + Microsoft Windows Server 2003 Web Edition + Microsoft Windows Server 2003 Web Edition + Microsoft Windows Server 2003 x64 SP2 + Microsoft Windows Server 2003 x64 SP2 + Microsoft Windows XP 64-bit Edition + Microsoft Windows XP 64-bit Edition + Microsoft Windows XP Home + Microsoft Windows XP Home + Microsoft Windows XP Home + Microsoft Windows XP Media Center Edition SP2 + Microsoft Windows XP Media Center Edition SP2 + Microsoft Windows XP Media Center Edition + Microsoft Windows XP Media Center Edition + Microsoft Windows XP Media Center Edition + Microsoft Windows XP Professional + Microsoft Windows XP Professional + Microsoft Windows XP Professional + Microsoft Windows XP Professional x64 Edition SP2 + Microsoft Windows XP Professional x64 Edition SP2 + Microsoft Windows XP Tablet PC Edition SP2 + Microsoft Windows XP Tablet PC Edition SP2 + Microsoft Windows XP Tablet PC Edition + Microsoft Windows XP Tablet PC Edition

Not Vulnerable:

Discussion

Microsoft Outlook Express 6 Plain Text Message Script Execution Vulnerability

Microsoft Outlook Express 6 contains a vulnerability which allows an email message of content-type 'text/plain' to execute specifically crafted scripting components.

It is important to note that Outlook Express 6 does not allow any scripting to be executed by default. This security feature must be turned off in order to exploit this vulnerability.

Exploit / POC

Microsoft Outlook Express 6 Plain Text Message Script Execution Vulnerability

There is no exploit required.

Solution / Fix

Microsoft Outlook Express 6 Plain Text Message Script Execution Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

References

Microsoft Outlook Express 6 Plain Text Message Script Execution Vulnerability

References: