Microsoft Multiple E-Mail Client Address Spoofing Vulnerability

04.08.05

BACKGROUND

Microsoft Outlook provides an integrated solution for managing and
organizing e-mail messages, schedules, tasks, notes, contacts, and other
information. More information is available at

http://www.microsoft.com/outlook/

DESCRIPTION

Remote exploitation of an address spoofing vulnerability in various
Microsoft Corp. e-mail clients could allow attackers to social engineer
sensitive information from end users.

Microsoft Outlook and Microsoft Outlook Web Access (OWA) are widely
deployed collaboration clients in corporate networks. The vulnerability
specifically exists in message header parsing and allows an attacker to
spoof the "From" field that is displayed on the user's screen. Within
the SMTP header, when the From field contains multiple comma-separated
addresses, Outlook and OWA will only display the first address. Consider
the following example header:

From: support@your.company, Phisher <phisher@attackers.domain>

Outlook and OWA will only display the address "support@your.company" as
the sender address.

ANALYSIS

While server-side e-mail spoofing is a known matter, this issue is
relevant as it exists within the client. Consider the following example:
A corporate SMTP server is configured to drop all mail received from the
external network claiming to be from an internal address. By exploiting
this issue, an attacker can bypass the imposed restrictions and transmit
a message that appears to come from an internal user. This attack,
combined with social engineering, could potentially lead to further
compromise.

DETECTION

Microsoft Outlook as distributed with Office XP and 2003 as well as
Outlook Web Access as distributed with Exchange 2003 have been confirmed
as vulnerable. Prior versions are suspected to be affected as well.

Microsoft Outlook Express is not affected by this issue.

WORKAROUND

Examine the full mail headers of any suspicious e-mail messages prior to
taking described actions or following live links.

VENDOR RESPONSE

Microsoft has reviewed the issue and has made the determination that
while a bug fix may be implemented in a future service pack, a security
advisory/patch will not be released for this issue.

CVE INFORMATION

The Common Vulnerabilities and Exposures (CVE) project has assigned the
names CAN-2005-1052 to these issues. This is a candidate for inclusion
in the CVE list (http://cve.mitre.org), which standardizes names for
security problems.

DISCLOSURE TIMELINE

01/21/2005   Initial vendor notification
01/24/2005   Initial vendor response
04/08/2005   Public disclosure

CREDIT

This vulnerability was discovered by Sergey V. Gordeychik.

Get paid for vulnerability research
http://www.idefense.com/poi/teams/vcp.jsp

Free tools, research and upcoming events
http://labs.idefense.com

LEGAL NOTICES

Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDEFENSE. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically, please
email customerservice@idefense.com for permission.

Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on,
this information.