Microsoft Office mailto URI remote code execution

Overview

A vulnerability in the way that Microsoft Outlook handles a certain type of hyperlink could allow a remote attacker to execute arbitrary code on the vulnerable system.

Description

Microsoft Outlook provides a centralized application for managing and organizing e-mail messages, schedules, tasks, notes, contacts, and other information. Outlook is included as a component of newer versions of Microsoft Office and available as a stand-alone product.

Outlook exposes a vulnerability due to inadequate checking of parameters passed to the Outlook email client. The vulnerability is caused due to the manner in which Outlook interprest a mailto: URI. By creating a specially formatted mailto: URI, an attacker may be able to alter the way that Outlook is invoked in order to allow code execution. The malicious code could be delivered to the victim via a specially-crafted HTML email message or from a webpage controlled by the attacker.

---

Impact

Successful exploitation of this vulnerability could allow a remote, unauthenticated attacker to execute arbitrary code. Upon successful exploitation, the malicious code would be executed in the context of the “Local Machine” under the user running Outlook.

---

Solution

Apply Update
Microsoft has addressed this vulnerability in Microsoft Security Bulletin MS08-015.

---

Workaround

As stated directly from MS08-015:

Disabling the mailto handler in the system registry key helps protect affected systems from attempts to exploit this vulnerability.

---

Vendor Information

393305

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Microsoft Corporation __ Affected

Updated: March 11, 2008

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Microsoft has addressed this vulnerability in Microsoft Security Bulletin MS08-015.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23393305 Feedback>).

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://www.microsoft.com/technet/security/bulletin/ms08-015.mspx&gt;
• <http://blogs.technet.com/swi/archive/2008/03/11/protocol-handler-and-its-default-security-zone.aspx&gt;

Acknowledgements

Microsoft acknowledges Greg MacManus of iDefense Labs for reporting this vulnerability.

This document was written by Joseph W. Pruszynski.

Other Information

CVE IDs:	CVE-2008-0110
Severity Metric:	26.33 Date Public: