CVE-2004-0121 Argument injection vulnerability in Microsoft Outlook 2002 does not sufficiently filter parameters of mailto: URLs when using them as arguments when calling OUTLOOK.EXE, which allows remote attackers....
HighCVSS 7.5
EPSS 47.7%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Argument injection vulnerability in Microsoft Outlook 2002 does not sufficiently filter parameters of mailto: URLs when using them as arguments when calling OUTLOOK.EXE, which allows remote attackers to use script code in the Local Machine zone and execute arbitrary programs.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft office | = xp-sp2 | No fix listed |
| Microsoft outlook | = 2002-sp2 | No fix listed |
References
- 20040310 Outlook mailto: URL argument injection vulnerability mailing-list third-party-advisory
- O-096 broken-link government-resource third-party-advisory
- 20040309 Microsoft Outlook "mailto:" Parameter Passing Vulnerability broken-link patch third-party-advisory vendor-advisory
- VU#305206 mitigation third-party-advisory us-government-resource
- 9827 broken-link exploit patch third-party-advisory vdb-entry vendor-advisory
- TA04-070A broken-link third-party-advisory us-government-resource
- MS04-009 patch vendor-advisory
- outlook-mailtourl-execute-code(15414) third-party-advisory vdb-entry
- outlook-ms04009-patch(15429) third-party-advisory vdb-entry
- oval:org.mitre.oval:def:843 broken-link signature vdb-entry