SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (E-mail Client)  >   Microsoft Outlook Express Vendors:   Microsoft
Microsoft Outlook Express MHTML Parsing Error Lets Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1016654
SecurityTracker URL:  http://securitytracker.com/id/1016654
CVE Reference:   CVE-2006-2766   (Links to External Site)
Date:  Aug 8 2006
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): 6
Description:   A vulnerability was reported in Microsoft Outlook Express. A remote user can cause arbitrary code to be executed on the target user's system.

A remote user can create specially crafted HTML that, when loaded by the target user, will trigger an error in the MHTML parser and execute arbitrary code on the target user's system. The code will run with the privileges of the target user.

Windows 2000-based systems are not affected. Windows XP SP1 is not affected. Windows 2003 (prior to SP1) is not affected.

This vulnerability was originally reported in May 2006 by Mr. Niega as an Internet Explorer vulnerability.

Impact:   A remote user can create a HTML that, when loaded by the target user, will execute arbitrary code on the target user's system.
Solution:   The vendor has issued the following fixes:

Outlook Express 6 on Microsoft Windows XP Service Pack 2:

http://www.microsoft.com/downloads/details.aspx?FamilyId=c9037cdb-3a57-4db7-aa0d-5ad28730303a

Outlook Express 6 on Microsoft Windows XP Professional x64 Edition:

http://www.microsoft.com/downloads/details.aspx?familyid=71f09617-d3cd-45fb-a09b-a9025c1d3f47

Outlook Express 6 on Microsoft Windows Server 2003 Service Pack 1:

http://www.microsoft.com/downloads/details.aspx?FamilyId=0c7e507f-2a42-49b5-82b2-84a6ec40b895

Outlook Express 6 on Microsoft Windows Server 2003 with SP1 for Itanium:

http://www.microsoft.com/downloads/details.aspx?familyid=8f062b1c-7b93-4cb2-835a-b58ba29435f2

Outlook Express 6 on Microsoft Windows Server 2003 x64 Edition:

http://www.microsoft.com/downloads/details.aspx?FamilyId=2aa6b4d1-a6eb-425b-ab7e-6cc27124a59e

The Microsoft advisory is available at:

http://www.microsoft.com/technet/security/bulletin/ms06-043.mspx

A restart is not required.

Vendor URL:  www.microsoft.com/technet/security/bulletin/ms06-043.mspx (Links to External Site)
Cause:   Input validation error, State error
Underlying OS:  Windows (2003), Windows (XP)

Message History:   None.


 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC