CVE-2002-0285

Outlook Express 5.5 and 6.0 on Windows treats a carriage return "CR" in a message header as if it were a valid carriage return/line feed combination CR/LF, which could allow remote attackers to bypass virus protection and or other filtering mechanisms via a mail message with headers that only...

ie.css.txt

Thor Larholm security advisory TL002 Topic: IE allows universal Cross Site Scripting. Discovery date: 18 March 2002. Affected applications: Any application that hosts the WebBrowser control IE6+. Some of these are: Microsoft Internet Explorer Microsoft Outlook Microsoft Outlook Express Severity:...

Re: dH team & SECURITY.NNOV: special device access, information leakage and DoS in Outlook Express

At Wednesday 5/15/2002 03:11 PM +0400, you wrote: Title: Special device access and DoS in Microsoft Internet Exporer/Outlook Express/Outlook All versions of Windows have a reserved filenames referred to special devices such as prn, aux, nul, etc also called DOS devices. This might be related to a...

Re[2]: dH team & SECURITY.NNOV: special device access, information leakage and DoS in Outlook Express

Dear Chad Loder, You're right! bgsound src=3D"111.111.111.111newfile.wav" causes IE to connect to 111.111.111.111 via NetBT. Depending on LMCompatibilityLevel it may cause user's cleartext password or NTLMv1 challenge to leak. It's very serious bug. --Friday, May 17, 2002, 1:38:16 PM, you wrote t...

CVE-2002-1056

Microsoft Outlook 2000 and 2002, when configured to use Microsoft Word as the email editor, does not block scripts that are used while editing email messages in HTML or Rich Text Format RTF, which could allow remote attackers to execute arbitrary scripts via an email that the user forwards or...

dH team & SECURITY.NNOV: special device access, information leakage and DoS in Outlook Express

Русская версия этой advisory приведена ниже. Original version of this advisory: http://www.security.nnov.ru/advisories/msiedos.asp Title: Special device access and DoS in Microsoft Internet Exporer/Outlook Express/Outlook Authors: ERRor, 3APA3A Date: May, 14 2002 Affected: Internet Explorer 6.0...

Special device access and DoS in Microsoft Internet Exporer

Title: special device access and DoS in Microsoft Internet Exporer/Outlook Express/Outlook Authors: ERRor, 3APA3A Date: May, 14 2002 Affected: Internet Explorer 6.0 Vendor: Microsoft Risk: Average to high Remote: Yes Exploitable: Yes Vendor notified: April, 24 2002 Intro: All versions of Windows...

CVE-2001-1325

CVE-2001-1325 affects Internet Explorer 5.0/5.5 and Outlook Express 5.0/5.5. The vulnerability allows remote script execution when Active Scripting is disabled if scripts are embedded in XML stylesheets (XSL) loaded via an IFRAME, potentially tied to Windows Scripting Host (WSH). OpenVAS findings...

CVE-2001-1325

Internet Explorer 5.0 and 5.5, and Outlook Express 5.0 and 5.5, allow remote attackers to execute scripts when Active Scripting is disabled by including the scripts in XML stylesheets XSL that are referenced using an IFRAME tag, possibly due to a vulnerability in Windows Scripting Host WSH...

CVE-2002-0285

Outlook Express 5.5 and 6.0 on Windows treats a carriage return "CR" in a message header as if it were a valid carriage return/line feed combination CR/LF, which could allow remote attackers to bypass virus protection and or other filtering mechanisms via a mail message with headers that only...

CVE-2002-0285

Outlook Express 5.5 and 6.0 on Windows is affected. A CR in a message header is treated as a valid CR/LF, allowing header splitting that can bypass virus protection and other filters by sending a mail message whose headers contain only the CR, which causes Outlook to create separate headers. Root...

Security Bulletin MS02-021: E-mail Editor Flaw Could Lead to Script Execution on Reply or Forward (Q321804)

---------------------------------------------------------------------- Title: E-mail Editor Flaw Could Lead to Script Execution on Reply or Forward Q321804 Date: 25 April 2002 Software: Microsoft Outlook Impact: Run Code of Attacker's Choice Max Risk: Moderate Bulletin: MS02-021 Microsoft...

Special DOS-device access in Microsoft Outlook Express

It's possible to hang Outlooks Express by using prn: device as a name for bgsound or iframe. It's also possible to send data to special device...

Microsoft Outlook Express 5.5 - Denial of Service Device Denial of Service

source: https://www.securityfocus.com/bid/4584/info A denial of service issue has been reported in Microsoft Outlook Express. Reportedly, Outlook Express does not adequately handle unusually crafted HTML mail messages. Modifying the BGSOUND or IFRAME tag to contain a URL pointing to a DOS device,...

Microsoft Outlook Express 5.5 - Denial of Service Device Denial of Service

Microsoft Outlook Express 5.5 - Denial of Service Device Denial of Service source: https://www.securityfocus.com/bid/4584/info A denial of service issue has been reported in Microsoft Outlook Express. Reportedly, Outlook Express does not adequately handle unusually crafted HTML mail messages...

Special DOS device DoS against Microsoft Outlook Express

Summary: ======== Affected: Outlook Express 5.5, 6.0 with all fixes Not tested: Microsoft Outlook Vendor: Microsoft Risk: Average Remote: Yes Exploitable: Yes Description: ========== Outlook Express hangs on HTML message with BGSOUND or IFRAME tag pointing to special device. Outlook Express will...

w00w00 on Microsoft IE/Office for Mac OS

w00w00 http://www.w00w00.org Angry Packet Security http://sec.angrypacket.com Vulnerability in Multiple Microsoft Products for Mac OS HTML format: http://www.w00w00.org/advisories/msmacos.html Text format: http://www.w00w00.org/files/advisories/msmacos.txt SOFTWARE VERSIONS AFFECTED Microsft...

More fun with html mail: Outlook Express, Internet Explorer, Other etc

Sunday, April 14, 2002 1. Not Possible Technically it cannot be possible to create an html mail message from a mailto url scheme without user input. However shoe-horning html in through insertion of script tags does make it possible. Default installation of Outlook Express and probably Outlook, i...

Microsoft Internet Explorer 56 Outlook 200020025.5 Word 20002002 - VBScript ActiveX Word Object Denial of Service

Microsoft Internet Explorer 56 Outlook 200020025.5 Word 20002002 - VBScript ActiveX Word Object Denial of Service source: https://www.securityfocus.com/bid/4463/info A vulnerability has been discovered which is reported to affect Microsoft Internet Explorer, Outlook and Word. Other Office...

Microsoft Internet Explorer 5/6 / Outlook 2000/2002/5.5 / Word 2000/2002 - VBScript ActiveX Word Object Denial of Service

source: https://www.securityfocus.com/bid/4463/info A vulnerability has been discovered which is reported to affect Microsoft Internet Explorer, Outlook and Word. Other Office components may also be affected by this issue. It is possible to misuse VBScript ActiveX Word objects to cause a denial o...