Outlook Express Attachment Carriage Return/Linefeed Encapsulation Filtering Bypass Vulnerability

Bugtraq ID:	4092
Class:	Design Error
CVE:	CVE-2002-0285
Remote:	Yes
Local:	No
Published:	Feb 13 2002 12:00AM
Updated:	Jul 11 2009 10:56AM
Credit:	This vulnerability was discovered by Valentijn Sessink <[email protected]>.
Vulnerable:	Microsoft Outlook Express 5.5 + Microsoft Internet Explorer 5.0.1 for Windows NT 4.0 + Microsoft Internet Explorer 5.0.1 for Windows NT 4.0 + Microsoft Internet Explorer 5.0.1 for Windows 98 + Microsoft Internet Explorer 5.0.1 for Windows 98 + Microsoft Internet Explorer 5.0.1 for Windows 95 + Microsoft Internet Explorer 5.0.1 for Windows 95 + Microsoft Internet Explorer 5.0.1 for Windows 2000 + Microsoft Internet Explorer 5.0.1 for Windows 2000 + Microsoft Internet Explorer 5.0.1 + Microsoft Internet Explorer 5.0.1 + Microsoft Internet Explorer 5.5 + Microsoft Internet Explorer 5.5 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows 98SE - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0
Not Vulnerable:

Outlook Express Attachment Carriage Return/Linefeed Encapsulation Filtering Bypass Vulnerability

Outlook Express is a freely available Mail User Agent (MUA) for Microsoft Windows Operating Systems. It is distributed and maintained by Microsoft.

It is possible to send attachments to Outlook Express users using non-standard attachment techniques. This can be accomplished by encapsulating the data in Carriage Return (<CR>) specifiers in the Subject line of an email. Upon receiving an email with a subject line containing carriage returns, Outlook Express will interpret the data section of the mail beginning in the subject line. This problem is compounded by the fact that mail filtering utilities do not search the subject line for this type of data, and can allow a malicious file to pass to an Outlook Express user.

Outlook Express Attachment Carriage Return/Linefeed Encapsulation Filtering Bypass Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.