search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Microsoft Outlook and Microsoft Exchange TNEF decoding buffer overflow

Vulnerability Note VU#252146

Original Release Date: 2006-01-10 | Last Revised: 2006-01-17

Overview

Microsoft Outlook and Microsoft Exchange contain a buffer overflow vulnerability that may allow a remote, unauthenticated attacker to execute arbitrary code on a system running the vulnerable software.

Description

Transport Neutral Encapsulation Format (TNEF)

TNEF is a proprietary Microsoft format for encoding rich text email messages. Microsoft Outlook and Microsoft Exchange support the use of TNEF-encoded messages.

The problem

Microsoft Outlook and Microsoft Exchange do not properly validate TNEF MIME attachments, potentially allowing a buffer overflow to occur. The overflow occurs in in the process that decodes TNEF MIME attachments. A remote attacker may be able trigger the buffer overflow by sending a specially crafted TNEF MIME attachment to a vulnerable Outlook or Exchange installation.

Note that on user workstations, exploitation may require a user to open or preview a malicious mail message in Outlook. However, on Exchange servers, this vulnerability can be exploited without human interaction.

For more information, please see Microsoft Security Bulletin MS06-003.

Impact

A remote unauthenticated attacker may be able to execute arbitrary code on a system running the vulnerable software. Microsoft Outlook can trigger the vulnerability when it opens or displays a preview for a specially crafted message. Microsoft Exchange can trigger the vulnerability when it processes a specially crafted message.

Solution

Apply a patch from your vendor
Microsoft addresses this vulnerability with the updates listed in Microsoft Security Bulletin MS06-003.


Workarounds

Microsoft has listed several workarounds in Microsoft Security Bulletin MS06-003, including blocking attachments with the MIME type of application/ms-tnef.

Vendor Information

252146
 
Affected   Unknown   Unaffected

Microsoft Corporation

Updated:  January 10, 2006

Status

  Vulnerable

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see Microsoft Security Bulletin MS06-003.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A

References

Acknowledgements

This vulnerability was reported by Microsoft, who in turn credit John Heasman and Mark Litchfield of NGS Software.

This document was written by Will Dormann and Jeff Gennari.

Other Information

CVE IDs: CVE-2006-0002
Severity Metric: 25.52
Date Public: 2006-01-10
Date First Published: 2006-01-10
Date Last Updated: 2006-01-17 01:26 UTC
Document Revision: 21

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.