Vulnerability Note VU#252146
Microsoft Outlook and Microsoft Exchange TNEF decoding buffer overflow
Microsoft Outlook and Microsoft Exchange contain a buffer overflow vulnerability that may allow a remote, unauthenticated attacker to execute arbitrary code on a system running the vulnerable software.
Transport Neutral Encapsulation Format (TNEF)
TNEF is a proprietary Microsoft format for encoding rich text email messages. Microsoft Outlook and Microsoft Exchange support the use of TNEF-encoded messages.
A remote unauthenticated attacker may be able to execute arbitrary code on a system running the vulnerable software. Microsoft Outlook can trigger the vulnerability when it opens or displays a preview for a specially crafted message. Microsoft Exchange can trigger the vulnerability when it processes a specially crafted message.
Apply a patch from your vendor
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Microsoft Corporation||Affected||-||10 Jan 2006|
CVSS Metrics (Learn More)
This vulnerability was reported by Microsoft, who in turn credit John Heasman and Mark Litchfield of NGS Software.
This document was written by Will Dormann and Jeff Gennari.
- CVE IDs: CVE-2006-0002
- Date Public: 10 Jan 2006
- Date First Published: 10 Jan 2006
- Date Last Updated: 16 Jan 2006
- Severity Metric: 25.51
- Document Revision: 21
If you have feedback, comments, or additional information about this vulnerability, please send us email.