|
Microsoft Outlook External Reference Vulnerability
|
|
Secunia Advisory:
|
SA11595
|
|
|
Release Date:
|
2004-05-12
|
|
Last Update:
|
2004-06-07
|
|
Popularity:
|
10,995 views
|
|
|
Critical:
|
Less critical
|
|
Impact:
|
Security Bypass
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | Microsoft Office 2003 Professional Edition
Microsoft Office 2003 Small Business Edition
Microsoft Office 2003 Standard Edition
Microsoft Office 2003 Student and Teacher Edition
Microsoft Outlook 2003
|
|
|
Secunia CVSS-2 Score:
|
Available in Secunia business solutions 
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities
|
|
| Advisory Content (Page 1 of 3) | [ 1 ] [ 2 ] [ 3 ] | |
|
Description:
http-equiv has reported a security issue in Microsoft Outlook, potentially allowing malicious people (spammers) to verify if a recipient has read an email.
Outlook 2003 is supposed to protect against objects being loaded from external resources when reading emails. However, it is possible to cause Outlook to load certain XML objects from external web servers. This can be exploited to verify the existence of recipients, but may also allow loading of content, which would be filtered by other email filters.
Additionally, http-equiv has reported that it is possible to spawn a password dialog box, using a style sheet with reference to a website using .htaccess style authentication. This could potentially be used to trick users into entering passwords to sensitive systems.
These issues has been reported to affect Outlook 2003. Other versions may also be affected by similar issues, however, they do not promise to protect the users in the same way as Outlook 2003.
Change Page:
[ 1 ] [ 2 ] [ 3 ]
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
