Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!

TUCoPS :: Windows Net Apps :: hack7869.htm

Microsoft Multiple E-Mail Client Address Spoofing vuln
iDEFENSE Security Advisory 04.08.05: Microsoft Multiple E-Mail Client Address Spoofing Vulnerability

Microsoft Multiple E-Mail Client Address Spoofing Vulnerability

iDEFENSE Security Advisory 04.08.05 
April 8, 2005


Microsoft Outlook provides an integrated solution for managing and
organizing e-mail messages, schedules, tasks, notes, contacts, and other
information. More information is available at 


Remote exploitation of an address spoofing vulnerability in various
Microsoft Corp. e-mail clients could allow attackers to social engineer
sensitive information from end users.

Microsoft Outlook and Microsoft Outlook Web Access (OWA) are widely
deployed collaboration clients in corporate networks. The vulnerability
specifically exists in message header parsing and allows an attacker to
spoof the "From" field that is displayed on the user's screen. Within
the SMTP header, when the From field contains multiple comma-separated
addresses, Outlook and OWA will only display the first address. Consider
the following example header:

From:, Phisher  

Outlook and OWA will only display the address "" as 
the sender address.


While server-side e-mail spoofing is a known matter, this issue is
relevant as it exists within the client. Consider the following example:
A corporate SMTP server is configured to drop all mail received from the
external network claiming to be from an internal address. By exploiting
this issue, an attacker can bypass the imposed restrictions and transmit
a message that appears to come from an internal user. This attack,
combined with social engineering, could potentially lead to further


Microsoft Outlook as distributed with Office XP and 2003 as well as
Outlook Web Access as distributed with Exchange 2003 have been confirmed
as vulnerable. Prior versions are suspected to be affected as well.

Microsoft Outlook Express is not affected by this issue.


Examine the full mail headers of any suspicious e-mail messages prior to
taking described actions or following live links.


Microsoft has reviewed the issue and has made the determination that
while a bug fix may be implemented in a future service pack, a security
advisory/patch will not be released for this issue.


A Mitre Corp. Common Vulnerabilities and Exposures (CVE) number has not
been assigned yet.


01/21/2005  Initial vendor notification
01/24/2005  Initial vendor response
04/08/2005  Public disclosure


This vulnerability was discovered by Sergey V. Gordeychik.

Get paid for vulnerability research 

Free tools, research and upcoming events 


Copyright (c) 2005 iDEFENSE, Inc.

Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDEFENSE. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically, please
email for permission. 

Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on,
this information.

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH