• Article

Security Bulletin

Microsoft Security Bulletin MS01-012 - Critical

Outlook, Outlook Express VCard Handler Contains Unchecked Buffer

Published: February 22, 2001 | Updated: June 23, 2003

Version: 2.2

Originally posted: February 22, 2001
Updated: June 23, 2003

Summary

Who should read this bulletin:
Customers using Microsoft® Outlook or Outlook Express.

Impact of vulnerability:
Run code of attacker's choice.

Recommendation:
Customers using either Outlook or Outlook Express should apply the patch.

Affected Software:

  • Microsoft Outlook 98
  • Microsoft Outlook 2000
  • Microsoft Outlook Express 5.x

General Information

Technical details

Technical description:

Outlook Express provides several components that are used both by it and, if installed on the machine, Outlook. One such component, used to process vCards, contains an unchecked buffer.

By creating a vCard and editing it to contain specially chosen data, then sending it to another user, an attacker could cause either of two effects to occur if the recipient opened it. In the less serious case, the attacker could cause the mail client to fail. If this happened, the recipient could resume normal operation by restarting the mail client and deleting the offending mail. In the more serious case, the attacker could cause the mail client to run code of her choice on the user's machine. Such code could take any desired action, limited only by the permissions of the recipient on the machine.

Because the component that contains the flaw ships as part of OE, which itself ships as part of IE, the patch is specified in terms of the version of IE rather than OE or Outlook.

Mitigating Factors

  • There is no means by which a vCard could be made to open automatically, so the attacker would need to entice the recipient into opening the mail, then opening the vCard. As always, best practices recommend against opening untrusted e-mail attachments.

Vulnerability identifier: CAN-2001-0145

Frequently asked questions

What's the scope of this vulnerability?
This is a buffer overrun vulnerability. If an attacker created a vCard containing specially malformed data and then emailed it to someone who uses an affected version of Outlook or Outlook Express, the data in the vCard could, when opened, could cause code of the attacker's choice to run on the recipient's machine. Such code could take any action the user himself could take, including adding, changing or deleting data, communicating with web sites, reformatting the disk drive, and other actions. There is no capability via this vulnerability to cause a vCard to open automatically. As a result, the attacker would need to persuade the recipient to open the vCard.

What causes the vulnerability?
There is an unchecked buffer in a component of Outlook Express that processes vCards. By sending a vCard that contains specially chosen data in one of the fields, an attacker could overrun the buffer and cause code of her choice to run when the vCard was opened.

If this is a vulnerability in a component of Outlook Express, why is Outlook affected?
The affected component ships as part of Outlook Express, but is shared by Outlook. As a result, Outlook, if installed, is also affected by this vulnerability.

What's the difference between Outlook and Outlook Express?
Outlook Express (OE) is a free, basic mail client that ships as part of Internet Explorer. By default, OE is installed on every Windows system. In contrast, Outlook is a full-featured mail client that ships both as a stand-alone product and as part of the Office family. It's only installed on a machine if the user has specifically installed it.

What's a vCard?
VCards are virtual business cards - business cards that can be sent via e-mail, and added to the Contacts folder in Outlook and Outlook Express. VCards are typically sent as attachments to e-mails.

What's wrong with the way Outlook Express and Outlook handle vCards?
The component that processes vCards when they're opened contains an unchecked buffer. As a result, by editing a vCard to include excessively long data in one of the card's fields, an attacker could cause a buffer overrun to occur when the vCard was subsequently opened.

What would this enable the attacker to do?
Buffer overrun vulnerabilities typically can be exploited in either of two ways. If the buffer is overrun with random data, the application tends to fail. However, if it's overrun with specially chosen data, it's possible to, in essence, change the functionality of the application - in this case, OE or Outlook - while it's running. In this case, the former attack (overrunning the buffer with random data) wouldn't accomplish much, except to cause the mail client to fail. If this happened, the user could just restart it, delete the offending mail, and continue working. However, the latter attack would allow the attacker to make OE or Outlook do whatever she wanted on the machine of the person who opened the vCard, limited only by the recipient's permissions on the machine. If the recipient had few privileges on the machine, the code might be able to do very little. On the other hand, if the recipient had administrative privileges on the machine, the code could do virtually anything on the machine.

Could the attacker make a vCard open automatically?
No. Only the recipient could open the vCard. This means that the attacker would need to persuade or entice the recipient into opening it.

Would the vCard open when the recipient read the mail it was attached to?
No. The recipient would need to first open the mail, then open the vCard, in order for the vulnerability to be exploited. It's worth reiterating that security best practices recommend against ever opening an untrusted e-mail attachment. This not only means that it's a bad idea to open an attachment that's sent to you from someone you don't know, but also that it's a bad idea to open an attachment from someone you do know, if the circumstances of the e-mail seem unusual.

Suppose the recipient dragged the vCard into his Contacts folder without opening it. Would this pose a risk?
Yes. The component containing the flaw is executed when a vCard is copied to the Contacts folder.

Could someone accidentally create a vCard that exploits this vulnerability?
No. A vCard of this type could only be created by carefully modifying a legitimate vCard using a hexadecimal editor.

Why is the patch specified in terms of the version of IE that's on the machine, rather than the version of OE or Outlook?
Let's start with why the patch isn't specified in terms of the version of Outlook on the machine. As we discussed above, the component that's responsible for the vulnerability ships as part of OE, and is shared by Outlook. As a result, the version of Outlook that's on the machine hasn't any bearing on the version of the patch that's needed - it's the version of OE that's important. Now let's address why the patch isn't specified in terms of the version of OE. If OE were guaranteed to be present on every user's system, it would make sense to do this. But OE isn't always present. OE ships and is installed by default as part of IE, so it's on the vast majority of users' systems, but it is still possible to de-select it at installation time. If the owner of such a system installed Outlook onto the machine, Outlook would find that the needed component wasn't present on the machine, and would install the version of the OE component corresponding to the version of IE that's on the machine. (Outlook also upgrades the version of IE in some cases). Thus, it's the version of IE, not the version of OE or Outlook, that determines the right version of the patch that needs to be installed.

How do I tell what version of IE is on my system?
Start IE, then select About Internet Explorer from the Help menu to see the version number.

Who should apply the patch?
Any customer using Outlook Express or Outlook should apply the patch.

I'm using Outlook, but I de-selected OE at installation time. Do I need the patch?
Yes. When Outlook is installed, it checks to see whether the needed OE components are present. If they aren't, Outlook installs them.

What does the patch do?
The patch causes the affected component to truncate all inputs that are longer than the buffer that's designed to hold them.

Patch availability

Download locations for this patch

Note: As discussed in the FAQ, the patch is specific to the version of IE on the machine, rather than the version of either Outlook or Outlook Express.

Additional information about this patch

Installation platforms:

A patch is available for installation on systems running IE 5.01 Service Pack 1, IE 5.01 Service Pack 2, or IE 5.5 Service Pack 1.

Inclusion in future service packs:

The fix for this issue will be included in IE 5.5 Service Pack 2 and IE 6

Verifying patch installation:

  • To verify that the patch has been installed on the machine, open IE, select Help, then select About Internet Explorer and confirm that Q283908 is listed in the Update Versions field.
  • To verify the individual files, use the patch manifest provided in Knowledge Base article Q283908

Caveats:

  • If the patch is installed on a system running a version of IE other than the one it is designed for, an error message will be displayed saying that the patch is not needed. This message is incorrect, and users who see this message should upgrade to either IE 5.01 SP1 or IE 5.5 SP1 and install the patch.
  • When installed on Windows 2000, IE 5.5 SP1 does not upgrade the version of OE to the one needed by the patch. However, either IE 5.01 SP1 or Windows 2000 SP1 will install the correct version. As a result, Windows 2000 users who upgraded directly to IE 5.5 SP1 must either downgrade to IE 5.01 SP1 or apply Windows 2000 SP1 before applying the patch.

Localization:

Localized versions of this patch are under development. When completed, they will be available at the locations discussed in "Obtaining other security patches".

Obtaining other security patches:

Patches for other security issues are available from the following locations:

  • Security patches are available from the Microsoft Download Center, and can be most easily found by doing a keyword search for "security_patch"
  • Patches are also available from the WindowsUpdate web site

Other information:

Acknowledgments

Microsoft thanks Ollie Whitehouse of @Stake for reporting this issue to us and working with us to protect customers.

Support:

  • Microsoft Knowledge Base article Q283908 discusses this issue and will be available approximately 24 hours after the release of this bulletin. Knowledge Base articles can be found on the Microsoft Online Support web site.
  • Technical support is available from Microsoft Product Support Services. There is no charge for support calls associated with security patches.

Security Resources: The Microsoft TechNet Security Web Site provides additional information about security in Microsoft products.

Disclaimer:

The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Revisions:

  • V1.0 (February 22, 2001): Bulletin created
  • V1.1 (February 27, 2001): Added caveat regarding the case where Windows 2000 is upgraded directly to IE 5.5 SP1.
  • V2.1 (March 23, 2001): Updated Installation Platform section to indicate that the fix can be applied to IE 5.01 SP2.
  • V2.2 (June 23, 2003): Updated Windows Update download links.

Built at 2014-04-18T13:49:36Z-07:00 </https:>