Header Manipulation Vulnerability in Outlook Express by Microsoft

CVE-2002-0285

Summary

A vulnerability exists in Microsoft Outlook Express 5.5 and 6.0 on Windows where a carriage return ('CR') in a message header is incorrectly processed as a valid carriage return/line feed (CR/LF) pair. This flaw allows remote attackers to bypass virus protection and filtering mechanisms by crafting malicious email messages with headers that exclusively contain the CR. Consequently, Outlook Express creates separate headers, potentially leading to unauthorized access or other unintended behaviors.

References