CVE-2004-0121

Argument injection vulnerability in Microsoft Outlook 2002 does not sufficiently filter parameters of mailto: URLs when using them as arguments when calling OUTLOOK.EXE, which allows remote attackers to use script code in the Local Machine zone and execute arbitrary programs.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://marc.info/?l=bugtraq&m=107893704602842&w=2	Third Party Advisory
http://www.ciac.org/ciac/bulletins/o-096.shtml	Broken Link
http://www.idefense.com/application/poi/display?id=79&type=vulnerabilities	Broken Link Patch Vendor Advisory
http://www.kb.cert.org/vuls/id/305206	Mitigation Third Party Advisory US Government Resource
http://www.securityfocus.com/bid/9827	Broken Link Exploit Patch Third Party Advisory VDB Entry Vendor Advisory
http://www.us-cert.gov/cas/techalerts/TA04-070A.html	Broken Link Third Party Advisory US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-009	Patch Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/15414	Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/15429	Third Party Advisory VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A843	Broken Link

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:microsoft:office:xp:sp2::::::
	cpe:2.3:a:microsoft:outlook:2002:sp2::::::

History

No history.

Information

Published : 2004-04-15 04:00

Updated : 2024-02-13 18:00

NVD link : CVE-2004-0121

Mitre link : CVE-2004-0121

CVE.ORG link : CVE-2004-0121

JSON object : View

Products Affected

microsoft

outlook
office

CWE

CWE-88

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

{"id": "CVE-2004-0121", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2004-04-15T04:00:00.000", "references": [{"url": "http://marc.info/?l=bugtraq&m=107893704602842&w=2", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.ciac.org/ciac/bulletins/o-096.shtml", "tags": ["Broken Link"], "source": "cve@mitre.org"}, {"url": "http://www.idefense.com/application/poi/display?id=79&type=vulnerabilities", "tags": ["Broken Link", "Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.kb.cert.org/vuls/id/305206", "tags": ["Mitigation", "Third Party Advisory", "US Government Resource"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/9827", "tags": ["Broken Link", "Exploit", "Patch", "Third Party Advisory", "VDB Entry", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.us-cert.gov/cas/techalerts/TA04-070A.html", "tags": ["Broken Link", "Third Party Advisory", "US Government Resource"], "source": "cve@mitre.org"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-009", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15414", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15429", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A843", "tags": ["Broken Link"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-88"}]}], "descriptions": [{"lang": "en", "value": "Argument injection vulnerability in Microsoft Outlook 2002 does not sufficiently filter parameters of mailto: URLs when using them as arguments when calling OUTLOOK.EXE, which allows remote attackers to use script code in the Local Machine zone and execute arbitrary programs."}, {"lang": "es", "value": "Micrososft Outlook 2002 no filtra suficientemente los par\u00e1metros de URLs mailto:, cuando se usan como argumentos al llamar a OUTLOOK.EXE, lo que permite a atacantes remotos usar c\u00f3digo script en la zona de seguridad \"M\u00e1quina Local\" y ejecutar programas arbitrarios."}], "lastModified": "2024-02-13T18:00:46.930", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:office:xp:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9D02D769-061D-44A5-B019-F4E653DF615A"}, {"criteria": "cpe:2.3:a:microsoft:outlook:2002:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D0E20E02-43B2-499B-ADDD-B5B7003894D7"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}