Home    |    View Topics    |    Search    |    Contact Us    |   



Category:   Application (E-mail Client)  >   Microsoft Outlook Vendors:   Microsoft
Microsoft Outlook 'From' Address Display Lets Remote Users Spoof Origination Addresses
SecurityTracker Alert ID:  1013668
SecurityTracker URL:
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Apr 8 2005
Impact:   Modification of system information
Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): 2003, XP; possibly others
Description:   iDEFENSE reported a vulnerability in Microsoft Outlook. A remote user can spoof 'From' addresses.

A remote user can send e-mail with a specially crafted 'From' address header line to cause the sender's apparent e-mail address to be spoofed. If the 'From' field contains multiple, comma-separated addresses, the target user's client will display only the first address.

A demonstration exploit address header line is provided:

From:, Phisher <phisher@attackers.domain>

Microsoft Outlook Express is not affected.

The vendor was notified on January 21, 2005.

Sergey V. Gordeychik is credited with reporting this vulnerability.

Impact:   A remote user can spoof 'From' addresses.
Solution:   No solution was available at the time of this entry.
Vendor URL: (Links to External Site)
Cause:   State error
Underlying OS:  Windows (Any)

Message History:   None.

 Source Message Contents

Subject:  iDEFENSE Security Advisory 04.08.05: Microsoft Multiple E-Mail

Microsoft Multiple E-Mail Client Address Spoofing Vulnerability

iDEFENSE Security Advisory 04.08.05
April 8, 2005


Microsoft Outlook provides an integrated solution for managing and
organizing e-mail messages, schedules, tasks, notes, contacts, and other
information. More information is available at


Remote exploitation of an address spoofing vulnerability in various
Microsoft Corp. e-mail clients could allow attackers to social engineer
sensitive information from end users.

Microsoft Outlook and Microsoft Outlook Web Access (OWA) are widely
deployed collaboration clients in corporate networks. The vulnerability
specifically exists in message header parsing and allows an attacker to
spoof the "From" field that is displayed on the user's screen. Within
the SMTP header, when the From field contains multiple comma-separated
addresses, Outlook and OWA will only display the first address. Consider
the following example header:

    From:, Phisher <phisher@attackers.domain>

Outlook and OWA will only display the address "" as
the sender address.


While server-side e-mail spoofing is a known matter, this issue is
relevant as it exists within the client. Consider the following example:
A corporate SMTP server is configured to drop all mail received from the
external network claiming to be from an internal address. By exploiting
this issue, an attacker can bypass the imposed restrictions and transmit
a message that appears to come from an internal user. This attack,
combined with social engineering, could potentially lead to further


Microsoft Outlook as distributed with Office XP and 2003 as well as
Outlook Web Access as distributed with Exchange 2003 have been confirmed
as vulnerable. Prior versions are suspected to be affected as well.

Microsoft Outlook Express is not affected by this issue.


Examine the full mail headers of any suspicious e-mail messages prior to
taking described actions or following live links.


Microsoft has reviewed the issue and has made the determination that
while a bug fix may be implemented in a future service pack, a security
advisory/patch will not be released for this issue.


A Mitre Corp. Common Vulnerabilities and Exposures (CVE) number has not
been assigned yet.


01/21/2005  Initial vendor notification
01/24/2005  Initial vendor response
04/08/2005  Public disclosure


This vulnerability was discovered by Sergey V. Gordeychik.

Get paid for vulnerability research

Free tools, research and upcoming events


Copyright (c) 2005 iDEFENSE, Inc.

Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDEFENSE. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically, please
email for permission.

Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on,
this information.

Go to the Top of This SecurityTracker Archive Page

Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, LLC