BID:41446

Microsoft Outlook TNEF Stream With MAPI Attachment Remote Code Execution Vulnerability

Info

Microsoft Outlook TNEF Stream With MAPI Attachment Remote Code Execution Vulnerability

Bugtraq ID:	41446
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2010-0266
Remote:	Yes
Local:	No
Published:	Jul 13 2010 12:00AM
Updated:	Aug 16 2010 05:04PM
Credit:	Yorick Koster, working with the SSD/SecuriTeam Secure Disclosure program
Vulnerable:	Microsoft Outlook 2007 SP2 0 Microsoft Outlook 2007 SP1 0 Microsoft Outlook 2007 0 Microsoft Outlook 2003 SP3 Microsoft Outlook 2003 SP2 + Microsoft Office 2003 SP3 + Microsoft Office 2003 SP3 + Microsoft Office 2003 SP2 + Microsoft Office 2003 SP2 + Microsoft Office 2003 SP1 + Microsoft Office 2003 SP1 + Microsoft Office 2003 0 + Microsoft Office 2003 0 Microsoft Outlook 2003 0 + Microsoft Office 2003 SP3 + Microsoft Office 2003 SP3 + Microsoft Office 2003 SP2 + Microsoft Office 2003 SP2 + Microsoft Office 2003 SP1 + Microsoft Office 2003 SP1 + Microsoft Office 2003 0 + Microsoft Office 2003 0 Microsoft Outlook 2002 SP3 + Microsoft Office XP SP3 + Microsoft Office XP SP3 Microsoft Outlook 2002 SP2 + Microsoft Office XP SP2 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Terminal Services SP3 - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional Microsoft Outlook 2002 SP1 + Microsoft Office XP SP1 + Microsoft Office XP SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows 98SE - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows ME - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Home - Microsoft Windows XP Home - Microsoft Windows XP Professional - Microsoft Windows XP Professional - Microsoft Windows XP Professional Microsoft Outlook 2002 0 + Microsoft Office XP + Microsoft Office XP + Microsoft Office XP - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows 98SE - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows ME - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Home - Microsoft Windows XP Home - Microsoft Windows XP Professional - Microsoft Windows XP Professional - Microsoft Windows XP Professional

Not Vulnerable:

Discussion

Microsoft Outlook TNEF Stream With MAPI Attachment Remote Code Execution Vulnerability

Microsoft Outlook is prone to a remote code-execution vulnerability because it fails to properly verify attachments.

Attackers can exploit this issue by enticing an unsuspecting user into opening a specially crafted email attachment.

Successfully exploiting this issue will allow an attacker to execute arbitrary code with the privileges of the currently logged-in user. Failed exploit attempts will result in a denial-of-service condition.

Exploit / POC

Microsoft Outlook TNEF Stream With MAPI Attachment Remote Code Execution Vulnerability

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

Attackers can exploit this issue with readily available tools.

The following exploit codes are available:

/data/vulnerabilities/exploits/41446-1.rb
/data/vulnerabilities/exploits/41446-2.rb

Solution / Fix

Microsoft Outlook TNEF Stream With MAPI Attachment Remote Code Execution Vulnerability

Solution:
The vendor has released an advisory and fixes. Please see the references for more information.

Microsoft Outlook 2007 SP2 0

Microsoft Security Update for Microsoft Office Outlook 2007 (KB980376)
http://www.microsoft.com/downloads/details.aspx?familyid=4E2E7C49-6665 -4135-ADBB-8E831A91D0FE

Microsoft Outlook 2007 SP1 0

Microsoft Security Update for Microsoft Office Outlook 2007 (KB980376)
http://www.microsoft.com/downloads/details.aspx?familyid=4E2E7C49-6665 -4135-ADBB-8E831A91D0FE

Microsoft Outlook 2003 SP3

Microsoft Security Update for Microsoft Office Outlook 2003 (KB980373)
http://www.microsoft.com/downloads/details.aspx?familyid=EF5B0048-96F1 -43A6-9848-7F6ADCCD10B3

Microsoft Outlook 2002 SP3

Microsoft Security Update for Microsoft Outlook 2002 (KB980371)
http://www.microsoft.com/downloads/details.aspx?familyid=DAACF400-4AA3 -4479-A60F-B8863BA1E16D

References

Microsoft Outlook TNEF Stream With MAPI Attachment Remote Code Execution Vulnerability

References:

Microsoft Outlook Homepage (Microsoft )
MS10-045: Microsoft Office Outlook Remote Code Execution vulnerability (Microsoft Security Research and Defense)
Outlook PR_ATTACH_METHOD file execution vulnerability (Akita Software Security)
Microsoft Security Bulletin MS10-045 (Microsoft)