CVEvulnerability
CVE-2006-2055
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2006-04-26
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-88
Description
Argument injection vulnerability in Microsoft Outlook 2003 SP1 allows user-assisted remote attackers to modify command line arguments to an invoked mail client via " (double quote) characters in a mailto: scheme handler, as demonstrated by launching Microsoft Outlook with an arbitrary filename as an attachment. NOTE: it is not clear whether this issue is implementation-specific or a problem in the Microsoft API.
Affected configurations
• microsoft outlook 2003
Related
Weakness · CWE (1)
- CWE-88 Improper Neutralization of Argument Delimiters in a Command weakness
References
- http://ingehenriksen.blogspot.com/2006/04/office-2003-file-attachment-exploit.html Broken Link
- http://secunia.com/advisories/19819 Broken Link
- http://www.osvdb.org/25003 Broken Link
- http://www.securityfocus.com/archive/1/432009/100/0/threaded Broken Link, Third Party Advisory, VDB Entry
- http://www.vupen.com/english/advisories/2006/1538 Broken Link
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26118 Third Party Advisory, VDB Entry
- http://ingehenriksen.blogspot.com/2006/04/office-2003-file-attachment-exploit.html Broken Link
- http://secunia.com/advisories/19819 Broken Link
- http://www.osvdb.org/25003 Broken Link
- http://www.securityfocus.com/archive/1/432009/100/0/threaded Broken Link, Third Party Advisory, VDB Entry
- http://www.vupen.com/english/advisories/2006/1538 Broken Link
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26118 Third Party Advisory, VDB Entry