critical10.0Public exploit code
CVE-2004-0380
The MHTML protocol handler in Microsoft Outlook Express 5.5 SP2 through Outlook Express 6 SP1 allows remote attackers to bypass domain restrictions and execute…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Microsoft Internet Explorer 5.0.1 - ITS Protocol Zone Bypass (MS04-013)2004-02-13 · remote · windows · Verified
- Microsoft Outlook Express 6.0 - MHTML Forced File Execution (2)2003-11-25 · remote · windows · Verified
- Microsoft Outlook Express 6.0 - '.MHTML' Forced File Execution (1)2003-11-25 · remote · windows · Verified
Impact
The MHTML protocol handler in Microsoft Outlook Express 5.5 SP2 through Outlook Express 6 SP1 allows remote attackers to bypass domain restrictions and execute arbitrary code, as demonstrated on Internet Explorer using script in a compiled help (CHM) file that references the InfoTech Storage (ITS) protocol handlers such as (1) ms-its, (2) ms-itss, (3) its, or (4) mk:@MSITStore, aka the "MHTML URL Processing Vulnerability."
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | Outlook Express | Versions 5.5, 6.0 |
References
- NVD record
- CVE.org record
- http://secunia.com/advisories/10523
- http://www.k-otik.net/bugtraq/02.18.InternetExplorer.php
- http://www.kb.cert.org/vuls/id/323070
- http://www.securityfocus.com/archive/1/354447
- http://www.securityfocus.com/archive/1/358913
- http://www.securityfocus.com/bid/9105
- http://www.securityfocus.com/bid/9658
- http://www.us-cert.gov/cas/techalerts/TA04-104A.html
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-013
- https://exchange.xforce.ibmcloud.com/vulnerabilities/15705
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1010
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1028
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A882
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A990
- http://secunia.com/advisories/10523
- http://www.k-otik.net/bugtraq/02.18.InternetExplorer.php
- http://www.kb.cert.org/vuls/id/323070
- http://www.securityfocus.com/archive/1/354447
- http://www.securityfocus.com/archive/1/358913
- http://www.securityfocus.com/bid/9105
- http://www.securityfocus.com/bid/9658
- http://www.us-cert.gov/cas/techalerts/TA04-104A.html
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-013
- https://exchange.xforce.ibmcloud.com/vulnerabilities/15705
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1010