Microsoft Outlook Information Disclosure Vulnerability

An information disclosure vulnerability exists when Microsoft Outlook fails to properly validate authentication requests.

To exploit the vulnerability an attacker would have to trick a user into browsing to a malicious website or to an SMB or UNC path destination. Alternatively the attacker could convince a user to load a malicious document that initiates an NTLM validation request without the consent of the user. An attacker who successfully tricked a user into disclosing the user’s NTLM hash could attempt a brute-force attack to disclose the corresponding hash password.

The security update addresses the vulnerability by correcting how Outlook validates authentication requests.