Microsoft Outlook 97/98/2000, Outlook Express 4.0/5.0 GMT Field Buffer Overflow (2)

                                                source: http://www.securityfocus.com/bid/1481/info
 
All versions of Microsoft Outlook and Outlook Express are vulnerable to buffer overflow attacks where a remote user is capable of executing arbitrary code on an email recipient's system.
 
The problem lies in how Outlook and Outlook Express handles the parsing of the GMT section of the date field in the header of an email when downloading via POP3 or IMAP4. This process is handled by INETCOMM.DLL. Improper bounds checking exists on the token represented by GMT. Therefore, if a malicious user was to send a specially crafted email message containing an unusually long value in the GMT specification, the buffer would be overflowed making arbitrary code execution possible. Sending random data could cause the application to crash.
 
Eg:
 
Date: Tue, 18 July 2000 14:16:06 +1000<long string of characters>
 
This can also be achieved by encoding the specially formed GMT field as a MIME attachment in Outlook's MIME attached message format.
 
This lends itself to the possibility of a myriad of exploits, such as the execution of trojan horses, the spread of worms, gaining user level access on the target host, etc. automatically without the email recipient's consent to open an attachment or run an executable.
 
A user would only have to download an offending email in order to become susceptible to an attack.

Windows Console Version - 20079-2.exe
Windows Console Version Source - 20079-1.zip

http://www.exploit-db.com/sploits/20079-1.zip

http://www.exploit-db.com/sploits/20079-2.exe