|
|
An attacker could exploit the vulnerability by constructing a URL that, when clicked on by the user, would execute code of the attacker’s choice in the Local Computer security context. The URL could be hosted on a web page, or sent directly to the user in email. In the web based scenario, where a user then clicked on the URL hosted on a website, an attacker could have the ability to read or launch files already present on the local machine. In the case of an e-mail borne attack, if the user was using Outlook Express 6.0 or Outlook 2002 in their default configurations, or Outlook 98 or 2000 in conjunction with the Outlook Email Security Update, then an attack could not be automated and the user would still need to click on a URL sent in e-mail. However if the user was not using Outlook Express 6.0 or Outlook 2002 in their default configurations, or Outlook 98 or 2000 in conjunction with the Outlook Email Security Update, the attacker could cause an attack to trigger automatically without the user having to click on a URL contained in an e-mail.
Mitigating factors:
- The Help and Support Center function could not be started automatically in
Outlook Express or Outlook if the user is running Internet Explorer 6.0 Service
Pack 1.
- For an attack to be successful, the user would need to visit a website under
the attacker's control or receive an HTML e-mail from the attacker.
- Automatic exploitation of the vulnerability by an HTML email would be
blocked by Outlook Express 6.0 and Outlook 2002 in their default configurations,
and by Outlook 98 and 2000 if used in conjunction with the Outlook Email
Security Update.
Severity Rating:
Windows
Me
Critical
Vulnerability Indentifier: CAN-2003-0009
Source: Microsoft
|
|
|
 |
|
No Comments Allowed for Anonymous, please register |
|
| |
|
Login |
|
 |
|
|
|
|
· New User? · Click here to create a registered account.
|
|
|
Article Rating |
|
|
|
|
|
|
Average Score: 0
Votes: 0
|
|
|
