ID CVE-2004-0380
Summary The MHTML protocol handler in Microsoft Outlook Express 5.5 SP2 through Outlook Express 6 SP1 allows remote attackers to bypass domain restrictions and execute arbitrary code, as demonstrated on Internet Explorer using script in a compiled help (CHM) file that references the InfoTech Storage (ITS) protocol handlers such as (1) ms-its, (2) ms-itss, (3) its, or (4) mk:@MSITStore, aka the "MHTML URL Processing Vulnerability."
References
Vulnerable Configurations
  • cpe:2.3:a:microsoft:outlook_express:5.5:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:outlook_express:5.5:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:outlook_express:6.0:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:outlook_express:6.0:*:*:*:*:*:*:*
CVSS
Base: 10.0 (as of 12-10-2018 - 21:34)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:N/AC:L/Au:N/C:C/I:C/A:C
oval via4
  • accepted 2004-05-25T12:00:00.000-04:00
    class vulnerability
    contributors
    name Andrew Buttner
    organization The MITRE Corporation
    description The MHTML protocol handler in Microsoft Outlook Express 5.5 SP2 through Outlook Express 6 SP1 allows remote attackers to bypass domain restrictions and execute arbitrary code, as demonstrated on Internet Explorer using script in a compiled help (CHM) file that references the InfoTech Storage (ITS) protocol handlers such as (1) ms-its, (2) ms-itss, (3) its, or (4) mk:@MSITStore, aka the "MHTML URL Processing Vulnerability."
    family windows
    id oval:org.mitre.oval:def:1010
    status accepted
    submitted 2004-04-13T12:00:00.000-04:00
    title Microsoft Outlook Express v6.0,SP1 MHTML URL Processing Vulnerability
    version 63
  • accepted 2005-10-19T05:47:00.000-04:00
    class vulnerability
    contributors
    • name Andrew Buttner
      organization The MITRE Corporation
    • name Christine Walzer
      organization The MITRE Corporation
    description The MHTML protocol handler in Microsoft Outlook Express 5.5 SP2 through Outlook Express 6 SP1 allows remote attackers to bypass domain restrictions and execute arbitrary code, as demonstrated on Internet Explorer using script in a compiled help (CHM) file that references the InfoTech Storage (ITS) protocol handlers such as (1) ms-its, (2) ms-itss, (3) its, or (4) mk:@MSITStore, aka the "MHTML URL Processing Vulnerability."
    family windows
    id oval:org.mitre.oval:def:1028
    status accepted
    submitted 2004-04-13T12:00:00.000-04:00
    title Microsoft Outlook Express v6.0 for Server 2003 MHTML URL Processing Vulnerability
    version 65
  • accepted 2004-05-25T12:00:00.000-04:00
    class vulnerability
    contributors
    name Andrew Buttner
    organization The MITRE Corporation
    description The MHTML protocol handler in Microsoft Outlook Express 5.5 SP2 through Outlook Express 6 SP1 allows remote attackers to bypass domain restrictions and execute arbitrary code, as demonstrated on Internet Explorer using script in a compiled help (CHM) file that references the InfoTech Storage (ITS) protocol handlers such as (1) ms-its, (2) ms-itss, (3) its, or (4) mk:@MSITStore, aka the "MHTML URL Processing Vulnerability."
    family windows
    id oval:org.mitre.oval:def:882
    status accepted
    submitted 2004-04-13T12:00:00.000-04:00
    title Microsoft Outlook Express v5.5,SP2 MHTML URL Processing Vulnerability
    version 63
  • accepted 2015-08-10T04:01:13.091-04:00
    class vulnerability
    contributors
    • name Andrew Buttner
      organization The MITRE Corporation
    • name Maria Mikhno
      organization ALTX-SOFT
    definition_extensions
    comment Microsoft Outlook Express 6.0 for Windows XP/2003 is installed
    oval oval:org.mitre.oval:def:208
    description The MHTML protocol handler in Microsoft Outlook Express 5.5 SP2 through Outlook Express 6 SP1 allows remote attackers to bypass domain restrictions and execute arbitrary code, as demonstrated on Internet Explorer using script in a compiled help (CHM) file that references the InfoTech Storage (ITS) protocol handlers such as (1) ms-its, (2) ms-itss, (3) its, or (4) mk:@MSITStore, aka the "MHTML URL Processing Vulnerability."
    family windows
    id oval:org.mitre.oval:def:990
    status accepted
    submitted 2004-04-13T12:00:00.000-04:00
    title Microsoft Outlook Express v6.0 MHTML URL Processing Vulnerability
    version 66
refmap via4
bid
  • 9105
  • 9658
bugtraq
  • 20040219 Microsoft Internet Explorer Unspecified CHM File Processing Arbitrary Code Execution Vulnerability (bid 9658)
  • 20040328 IE ms-its: and mk:@MSITStore: vulnerability
cert
  • TA04-099A
  • TA04-104A
cert-vn VU#323070
misc http://www.k-otik.net/bugtraq/02.18.InternetExplorer.php
ms MS04-013
secunia 10523
xf outlook-mhtml-execute-code(15705)
Last major update 12-10-2018 - 21:34
Published 04-05-2004 - 04:00
Back to Top