CERTA-2006-AVI-018
Vulnerability from certfr_avis
Une vulnérabilité dans Microsoft Outlook et Microsoft Exchange permet à un utilisateur mal intentionné d'exécuter du code arbitraire à distance.
Description
Une erreur dans la mise en œuvre du décodage des pièces jointes au format TNEF (Transport Neutral Encapsulation Format) par Microsoft Outlook et Microsoft Exchange permet à un utilisateur distant mal intentionné d'exécuter du code arbitraire par le biais d'un message contenant une pièce jointe au format TNEF malicieusement constituée. L'exploitation est possible lors de la visualisation ou la prévisualisation d'un message dans Outlook ou lors du traitement du message par Exchange.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Microsoft | N/A | Microsoft Exchange Server 2000 Service Pack 3 ; | ||
| Microsoft | Office | Microsoft Outlook 2002 (Microsoft Office XP Service Pack 3) ; | ||
| Microsoft | N/A | Microsoft Exchange Server 5.0 Service Pack 2 ; | ||
| Microsoft | N/A | Microsoft Exchange Server 2003 Service Pack 1 et 2. | ||
| Microsoft | N/A | Microsoft Exchange Server 5.5 Service Pack 4 ; | ||
| Microsoft | Office | Microsoft Outlook 2003 (Microsoft Office 2003 Service Pack 1 et 2) ; | ||
| Microsoft | Office | Microsoft Outlook 2000 (Microsoft Office 2000 Service Pack 3) ; |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Microsoft Exchange Server 2000 Service Pack 3 ;",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Outlook 2002 (Microsoft Office XP Service Pack 3) ;",
"product": {
"name": "Office",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 5.0 Service Pack 2 ;",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2003 Service Pack 1 et 2.",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 5.5 Service Pack 4 ;",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Outlook 2003 (Microsoft Office 2003 Service Pack 1 et 2) ;",
"product": {
"name": "Office",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Outlook 2000 (Microsoft Office 2000 Service Pack 3) ;",
"product": {
"name": "Office",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Description\n\nUne erreur dans la mise en \u0153uvre du d\u00e9codage des pi\u00e8ces jointes au\nformat TNEF (Transport Neutral Encapsulation Format) par Microsoft\nOutlook et Microsoft Exchange permet \u00e0 un utilisateur distant mal\nintentionn\u00e9 d\u0027ex\u00e9cuter du code arbitraire par le biais d\u0027un message\ncontenant une pi\u00e8ce jointe au format TNEF malicieusement constitu\u00e9e.\nL\u0027exploitation est possible lors de la visualisation ou la\npr\u00e9visualisation d\u0027un message dans Outlook ou lors du traitement du\nmessage par Exchange.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2006-0002",
"url": "https://www.cve.org/CVERecord?id=CVE-2006-0002"
}
],
"initial_release_date": "2006-01-11T00:00:00",
"last_revision_date": "2006-01-11T00:00:00",
"links": [],
"reference": "CERTA-2006-AVI-018",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2006-01-11T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 dans Microsoft Outlook et Microsoft Exchange permet \u00e0\nun utilisateur mal intentionn\u00e9 d\u0027ex\u00e9cuter du code arbitraire \u00e0 distance.\n",
"title": "Vuln\u00e9rabilit\u00e9 dans Microsoft Outlook et Exchange",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft MS06-003 du 10 janvier 2006",
"url": "http://www.microsoft.com/france/technet/securite/MS06-003.mspx"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…