CVE-2001-1088

Microsoft Outlook 8.5 and earlier, and Outlook Express 5 and earlier, with the "Automatically put people I reply to in my address book" option enabled, do not notify the user when the "Reply-To" address is different than the "From" address, which could allow an untrusted remote attacker to spoof legitimate addresses and intercept email from the client that is intended for another user.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://support.microsoft.com/default.aspx?scid=kb%3BEN-US%3Bq234241
http://www.securityfocus.com/archive/1/188752	Exploit Vendor Advisory
http://www.securityfocus.com/bid/2823	Exploit Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/6655

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:microsoft:outlook:97:::::::*
	cpe:2.3:a:microsoft:outlook:98:::::::*
	cpe:2.3:a:microsoft:outlook:2000:::::::*
	cpe:2.3:a:microsoft:outlook_express:4.0:::::::*
	cpe:2.3:a:microsoft:outlook_express:4.5:::::::*
	cpe:2.3:a:microsoft:outlook_express:4.27.3110:::::::*
	cpe:2.3:a:microsoft:outlook_express:4.72.2106:::::::*
	cpe:2.3:a:microsoft:outlook_express:4.72.3120.0:::::::*
	cpe:2.3:a:microsoft:outlook_express:4.72.3612:::::::*
	cpe:2.3:a:microsoft:outlook_express:5.0:::::::*
	cpe:2.3:a:microsoft:outlook_express:5.5:::::::*

History

07 Nov 2023, 01:55

Type	Values Removed	Values Added
References	~~{'url': 'http://support.microsoft.com/default.aspx?scid=kb;EN-US;q234241', 'name': 'http://support.microsoft.com/default.aspx?scid=kb;EN-US;q234241', 'tags': [], 'refsource': 'CONFIRM'}~~	() http://support.microsoft.com/default.aspx?scid=kb%3BEN-US%3Bq234241 -

Information

Published : 2001-06-05 04:00

Updated : 2023-12-10 10:17

NVD link : CVE-2001-1088

Mitre link : CVE-2001-1088

CVE.ORG link : CVE-2001-1088

JSON object : View

Products Affected

microsoft

outlook
outlook_express

CWE

NVD-CWE-Other

{"id": "CVE-2001-1088", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2001-06-05T04:00:00.000", "references": [{"url": "http://support.microsoft.com/default.aspx?scid=kb%3BEN-US%3Bq234241", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/188752", "tags": ["Exploit", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/2823", "tags": ["Exploit", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/6655", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Microsoft Outlook 8.5 and earlier, and Outlook Express 5 and earlier, with the \"Automatically put people I reply to in my address book\" option enabled, do not notify the user when the \"Reply-To\" address is different than the \"From\" address, which could allow an untrusted remote attacker to spoof legitimate addresses and intercept email from the client that is intended for another user."}], "lastModified": "2023-11-07T01:55:41.180", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:outlook:97:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D1D5CC3A-E880-4727-AEBE-1E4FE5A43AF8"}, {"criteria": "cpe:2.3:a:microsoft:outlook:98:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "52970A43-173E-477B-80BF-6FDBB6B0EECD"}, {"criteria": "cpe:2.3:a:microsoft:outlook:2000:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D52F17AB-2C87-4C1A-91B5-267ABBCF5844"}, {"criteria": "cpe:2.3:a:microsoft:outlook_express:4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6764F97F-6906-4953-BB1C-AA6345FA8FBE"}, {"criteria": "cpe:2.3:a:microsoft:outlook_express:4.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "67AB674C-70E1-4CCB-8F88-0741AAE6DA6E"}, {"criteria": "cpe:2.3:a:microsoft:outlook_express:4.27.3110:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3A5A497C-D03E-4666-BFCE-632F9943DB96"}, {"criteria": "cpe:2.3:a:microsoft:outlook_express:4.72.2106:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5D635E46-B428-498D-9C6C-7CA9EB397C96"}, {"criteria": "cpe:2.3:a:microsoft:outlook_express:4.72.3120.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7769EE2E-A740-4AE8-B1B1-A5256C12601D"}, {"criteria": "cpe:2.3:a:microsoft:outlook_express:4.72.3612:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F6C57670-B009-4C06-BAFD-B5212750F298"}, {"criteria": "cpe:2.3:a:microsoft:outlook_express:5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1F71D6D7-6CB2-4BE9-839A-A5714144029C"}, {"criteria": "cpe:2.3:a:microsoft:outlook_express:5.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "57C8ACA2-A3C6-4435-9C0C-B316879FE1FA"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}