Description: A vulnerability has been reported in Microsoft Outlook Express, which can be exploited by malicious people to compromise a user's system.
The vulnerability is caused due to a boundary error within the parsing of NNTP responses when using Outlook Express as a newsgroup reader. This can be exploited to cause a buffer overflow via a malicious newsgroup server.
Successful exploitation requires that a user queries a malicious newsgroup server for news.
The vulnerability does not affect the following versions:
* Microsoft Windows Server 2003 Service Pack 1
* Microsoft Windows Server 2003 with SP1 for Itanium-based systems
* Microsoft Windows Server 2003 x64 Edition
* Microsoft Windows XP Professional x64 Edition
* Microsoft Windows XP Service Pack 2
Provided and/or discovered by: Discovered by anonymous person and reported via iDEFENSE.
Changelog: 2005-06-15: Added link to US-CERT vulnerability note.
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.