Description
Microsoft Outlook Express 6.0 and Outlook 2000, with the security zone set to Internet Zone, allows remote attackers to execute arbitrary programs via an HTML email with the CODEBASE parameter set to the program, a vulnerability similar to CAN-2002-0077.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Microsoft Outlook2000/Express 6.0 - Arbitrary Program Execution EDB-22280 · remote · Feb 24, 2003 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 20030223 O UT LO OK E XPRE SS 6 .00 : broken mailing-list
- outlook-codebase-execute-programs(11411) vdb-entry
- 6923 vdb-entry
- 20030224 Re: O UT LO OK E XPRE SS 6 .00 : broken mailing-list