Vulnerability

CERT-In Vulnerability Note CIVN-2010-0202
Microsoft Outlook Buffer Overflow Vulnerability

Original Issue Date:September 16, 2010

Severity Rating: HIGH

Systems Affected

Microsoft Office XP Service Pack 3
Microsoft Office 2003 Service Pack 3
Microsoft Office 2007 Service Pack 2

Component Affected

Microsoft Outlook 2002 Service Pack 3
Microsoft Outlook 2003 Service Pack 3
Microsoft Outlook 2007 Service Pack 2

Overview

A vulnerability has been reported in Microsoft Outlook, which could allow a remote attacker to execute an arbitrary code or compromise an affected system.

Description

This issue is caused due to an integer underflow error when parsing certain content in the Microsoft Outlook . A remote attacker could exploit this vulnerability via a specially crafted e-mail message to trigger a heap-based buffer overflow error. Successful exploitation of this vulnerability could allow a remote attacker to execute an arbitrary code.

Successful exploitation requires that Outlook is connected to an Exchange server with Online Mode (not default setting for Outlook 2003 and 2007) .

Note : Configurations where Outlook connects to an Exchange Server in the Cached Exchange Mode are not affected by this issue. In addition, configurations where Outlook uses POP or IMAP mail servers only are not affected by this vulnerability.

Workaround

Read e-mails in plain text.

Solution

Apply appropriate updates as mentioned in Microsoft Security Bulletin MS10-064

Vendor Information

Microsoft
http://www.microsoft.com/technet/security/bulletin/ms10-064.mspx

References

Microsoft
http://www.microsoft.com/technet/security/bulletin/ms10-064.mspx
http://support.microsoft.com/kb/2315011

Secunia
http://secunia.com/advisories/34075/

VUPEN
http://www.vupen.com/english/advisories/2010/2385

Securityfocus
http://www.securityfocus.com/bid/43063

CVE Name
CVE-2010-2728

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India