Microsoft Outlook Express DOS Device Denial of Service Vulnerability

Bugtraq ID:	4584
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Apr 24 2002 12:00AM
Updated:	Apr 24 2002 12:00AM
Credit:	Discovered by ERRor <[email protected]> and 3APA3A.
Vulnerable:	Microsoft Outlook Express 5.5 + Microsoft Internet Explorer 5.0.1 for Windows NT 4.0 + Microsoft Internet Explorer 5.0.1 for Windows NT 4.0 + Microsoft Internet Explorer 5.0.1 for Windows 98 + Microsoft Internet Explorer 5.0.1 for Windows 98 + Microsoft Internet Explorer 5.0.1 for Windows 95 + Microsoft Internet Explorer 5.0.1 for Windows 95 + Microsoft Internet Explorer 5.0.1 for Windows 2000 + Microsoft Internet Explorer 5.0.1 for Windows 2000 + Microsoft Internet Explorer 5.0.1 + Microsoft Internet Explorer 5.0.1 + Microsoft Internet Explorer 5.5 + Microsoft Internet Explorer 5.5 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows 98SE - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0
Not Vulnerable:

Microsoft Outlook Express DOS Device Denial of Service Vulnerability

A denial of service issue has been reported in Microsoft Outlook Express.

Reportedly, Outlook Express does not adequately handle unusually crafted HTML mail messages. Modifying the BGSOUND or IFRAME tag to contain a URL pointing to a DOS device, could cause Outlook Express to stop responding.

Under certain circumtances this issue may cause the system to consume CPU time.

Varying results have been reported when data is sent directly to a device, such as a denial of service, hardware failure, information disclosure or unauthorized device access.

Microsoft Outlook Express DOS Device Denial of Service Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Microsoft Outlook Express DOS Device Denial of Service Vulnerability

References: