Remote Code Execution Vulnerability in Microsoft Outlook Express and Outlook 2000

CVE-2003-1378

Summary

Microsoft Outlook Express 6.0 and Outlook 2000 are susceptible to a vulnerability that permits remote attackers to execute arbitrary programs. This can be achieved through the use of a crafted HTML email containing a CODEBASE parameter pointing to the program. If an affected user opens such an email while their security zone is set to the Internet Zone, the attacker can take control of the system, compromising both its integrity and confidentiality. This vulnerability is akin to similar issues identified in other products, raising significant security concerns for users relying on these email clients.

References