Microsoft Outlook 2003 Security Policy Bypass Vulnerability

vendor:

Outlook

by:

Unknown

5.5

CVSS

MEDIUM

Security policy bypass

693

CWE

Product Name: Outlook

Affected Version From: Microsoft Outlook 2003

Affected Version To: Microsoft Outlook 2003

Patch Exists: NO

Related CWE: Not provided

CPE: a:microsoft:outlook:2003

Metasploit:

Other Scripts:

Platforms Tested: Windows

Unknown

Microsoft Outlook 2003 Security Policy Bypass Vulnerability

By including a base64 encoded image in an email and labeling it in a sufficient manner, it is possible to reference the base64 encoded image, resulting in a policy bypass because the image will be automatically rendered when the email is viewed in Outlook 2003.

Mitigation:

No known mitigation

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/11446/info

Microsoft Outlook 2003 is reported prone to a security policy bypass vulnerability.

It is reported that by including a base64 encoded image in an email and labeling that image in a sufficient manner, it is then possible to reference this base64 encoded image.

This will result in a policy bypass because the image will be automatically rendered when the email is viewed in Outlook 2003. Although this issue is reported to affect Outlook 2003, other mail transfer agents may also be affected.

<img src="cid:malware">

------=_NextPart_000_0004_01C4B234.2209FD20
Content-Type: image/gif;
name="youlickit[1].gif"
Content-Transfer-Encoding: base64
Content-ID: <malware>

R0lGODlhogCiAOb/AP////8hAP8QAP8AAPdCAPcAAO97AO8IAOfeQufWUuetY+eUA
N7OEN7OAN7G