CVE-2001-1088 Microsoft Outlook 8.5 and earlier, and Outlook Express 5 and earlier, with the "Automatically put people I reply to in my address book" option enabled, do not notify the user when the "Reply-To" addre...
HighCVSS 7.5
EPSS 19.7%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Microsoft Outlook 8.5 and earlier, and Outlook Express 5 and earlier, with the "Automatically put people I reply to in my address book" option enabled, do not notify the user when the "Reply-To" address is different than the "From" address, which could allow an untrusted remote attacker to spoof legitimate addresses and intercept email from the client that is intended for another user.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft outlook | = 97 | No fix listed |
| Microsoft outlook | = 98 | No fix listed |
| Microsoft outlook | = 2000 | No fix listed |
| Microsoft outlook express | = 4.0 | No fix listed |
| Microsoft outlook express | = 4.5 | No fix listed |
| Microsoft outlook express | = 4.27.3110 | No fix listed |
| Microsoft outlook express | = 4.72.2106 | No fix listed |
| Microsoft outlook express | = 4.72.3120.0 | No fix listed |
| Microsoft outlook express | = 4.72.3612 | No fix listed |
| Microsoft outlook express | = 5.0 | No fix listed |
| Microsoft outlook express | = 5.5 | No fix listed |
References
- support.microsoft.com
- 20010605 SECURITY.NNOV: Outlook Express address book spoofing exploit mailing-list vendor-advisory
- 2823 exploit vdb-entry vendor-advisory
- outlook-address-book-spoofing(6655) vdb-entry