Microsoft Multiple E-Mail Client Address Spoofing Vulnerability iDEFENSE Security Advisory 04.08.05 http://www.idefense.com/application/poi/display?type=vulnerabilities April 8, 2005 I. BACKGROUND Microsoft Outlook provides an integrated solution for managing and organizing e-mail messages, schedules, tasks, notes, contacts, and other information. More information is available at http://www.microsoft.com/outlook/ II. DESCRIPTION Remote exploitation of an address spoofing vulnerability in various Microsoft Corp. e-mail clients could allow attackers to social engineer sensitive information from end users. Microsoft Outlook and Microsoft Outlook Web Access (OWA) are widely deployed collaboration clients in corporate networks. The vulnerability specifically exists in message header parsing and allows an attacker to spoof the "From" field that is displayed on the user's screen. Within the SMTP header, when the From field contains multiple comma-separated addresses, Outlook and OWA will only display the first address. Consider the following example header: From: firstname.lastname@example.org, Phisher
Outlook and OWA will only display the address "email@example.com" as the sender address. III. ANALYSIS While server-side e-mail spoofing is a known matter, this issue is relevant as it exists within the client. Consider the following example: A corporate SMTP server is configured to drop all mail received from the external network claiming to be from an internal address. By exploiting this issue, an attacker can bypass the imposed restrictions and transmit a message that appears to come from an internal user. This attack, combined with social engineering, could potentially lead to further compromise. IV. DETECTION Microsoft Outlook as distributed with Office XP and 2003 as well as Outlook Web Access as distributed with Exchange 2003 have been confirmed as vulnerable. Prior versions are suspected to be affected as well. Microsoft Outlook Express is not affected by this issue. V. WORKAROUND Examine the full mail headers of any suspicious e-mail messages prior to taking described actions or following live links. VI. VENDOR RESPONSE Microsoft has reviewed the issue and has made the determination that while a bug fix may be implemented in a future service pack, a security advisory/patch will not be released for this issue. VII. CVE INFORMATION A Mitre Corp. Common Vulnerabilities and Exposures (CVE) number has not been assigned yet. VIII. DISCLOSURE TIMELINE 01/21/2005 Initial vendor notification 01/24/2005 Initial vendor response 04/08/2005 Public disclosure IX. CREDIT This vulnerability was discovered by Sergey V. Gordeychik. Get paid for vulnerability research http://www.idefense.com/poi/teams/vcp.jsp Free tools, research and upcoming events http://labs.idefense.com X. LEGAL NOTICES Copyright (c) 2005 iDEFENSE, Inc. Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDEFENSE. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please email firstname.lastname@example.org for permission. Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.