Security Information Vulnerability Research Security Blog

VML case: Affected Outlook versions listed

September 23rd, 2006 by , Filed under: Commentary, Web

Test information about vulnerable Microsoft Outlook versions, credit to Sunbelt’s Eric Sites, is available from Sunbelt Software weblog.

They list the following information:

Outlook 2007 – 12.0.417.1006, Can view VML but apparently not vulnerable.
Outlook 2002 – not vulnerable
Outlook 2000 – not vulnerable
Outlook 2003 11.5608.8028 – not vulnerable
Outlook 2003 11.5608.5606– not vulnerable
Outlook 2003 11.6568.6568 SP2 – not tested
Outlook 2003 11.8010.8036 SP2 – vulnerable

As Mr. Eckelberry says “ironically” the latest version 2003 is confirmed as affected. :-( ;-)

Share
  • duke

    Outlook is NOT vulnerable because active scripting is disabled by default so a VML component can’t be initialized.

  • http://networksecurity.typepad.com/ Juha-Matti

    Several reports say that disabling Active Scripting is not a working workaround in Outlook, i.e. Outlook is reported as exploitable.

  • duke

    VML is a component and it’s handle such as an ActiveX so it requires user consent and a script to initialize it.

  • Share







  • Categories


Security RSS Subscribe