Actu
Vigil@nce: Microsoft Outlook, denial of service via extension
December 2010 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/
SYNTHESIS OF THE VULNERABILITY
An attacker can send an email with an attachment without an
extension, in order to stop Microsoft Outlook on the recipient’s
computer.
– Severity: 1/4
– Creation date: 29/11/2010
DESCRIPTION OF THE VULNERABILITY
The reading pane of Microsoft Outlook indicates attachments. User
can click on it, in order to access to the attachment.
A filename usually ends with an extension ("name.extension").
Outlook extracts the extension, in order to analyze it. However,
if the extension is missing ("name."), Outlook dereferences a NULL
pointer.
An attacker can therefore send an email with an attachment without
an extension, in order to stop Microsoft Outlook on the
recipient’s computer.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/Microsoft-Outlook-denial-of-service-via-extension-10160
