Microsoft Outlook Express Header Validation Denial of Service Weakness
http://secunia.com/advisories/12038/


Secunia Advisory: SA12038
Release Date: 2004-07-13

Critical: Not critical
Impact: DoS
Where: From remote

Software: Microsoft Outlook Express 6

Choose a product and view comprehensive vulnerability statistics and
all Secunia advisories affecting it.

CVE reference: CAN-2004-0215

Description:
A weakness has been discovered in Microsoft Outlook Express 6, which
can be exploited by malicious people to cause a DoS (Denial of
Service).

The weakness is caused due to an error when validating email headers.
This can be exploited to crash the application when a specially
crafted email is viewed.

This will only pose a problem if the preview pane is enabled, since
Outlook Express will crash each time it is started.

Solution:
Microsoft has issued cumulative patches. However, only Outlook Express
6 (without SP1) is affected by the weakness.

Microsoft Outlook Express 5.5 (requires SP2):
http://www.microsoft.com/downloa...-...displaylang=en

Microsoft Outlook Express 6:
http://www.microsoft.com/downloa...-...displaylang=en

Microsoft Outlook Express 6 (requires SP1):
http://www.microsoft.com/downloa...-...displaylang=en

Microsoft Outlook Express 6 (64 bit Edition with SP1):
http://www.microsoft.com/downloa...-...displaylang=en

Microsoft Outlook Express 6 on Windows Server 2003:
http://www.microsoft.com/downloa...-...displaylang=en

Microsoft Outlook Express 6 on Windows Server 2003 (64 bit edition):
http://www.microsoft.com/downloa...-...displaylang=en

Original Advisory:
MS04-018 (KB823353):
http://www.microsoft.com/technet/sec.../MS04-018.mspx





--
Meritorios de Filtrado (Kill-File Global):
tella llop, jm (N.B. 2003.10.25)


«Prefiero molestar con la verdad que complacer con adulaciones (Lucio Anneo Seneca)»