Shmuel Uzan

تتعلق المشكلة بالتحقق غير الكافي من صحة المدخلات في Microsoft Office Outlook، مما يسمح لمهاجم مصرح له بتنفيذ تعليمات برمجية محليًّا. وقد يسمح ذلك أيضًا للمهاجمين عن بُعد بتنفيذ تعليمات برمجية تعسفية والتأثير على النظام.

تسمح ثغرة خطيرة في Microsoft Office Outlook لمهاجم مصرح له بتنفيذ تعليمات برمجية محليًّا. ويحدث ذلك بسبب مشكلة تتعلق بـ«اجتياز المسار» (path traversal). ويمكن استغلال هذه الثغرة من قِبل المهاجمين الذين يستخدمون الهندسة الاجتماعية للحصول على وصول بامتيازات منخفضة. هناك تقارير تفيد بأن هذه المشكلة يتم استغلالها بشكل نشط.

Name of the Vulnerable Software and Affected Versions: Microsoft Outlook (affected versions not specified) Description: The issue is related to incorrect external control of a file name or path in Microsoft Outlook for Windows operating systems. Exploitation of this issue may allow an attacker to execute arbitrary code. It is described as a Form Injection Remote Code Execution (RCE) vulnerability. Researchers from Morphisec Threat Labs have identified this vulnerability, which is a zero-click vulnerability leveraging form injections. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Microsoft Outlook versions prior to the fixed version Description: A critical zero-click remote code execution vulnerability has been discovered in Microsoft Outlook. This vulnerability allows attackers to execute arbitrary code by sending a specially crafted email. The issue is related to the use of an incomplete blacklist when processing input data, which can be exploited by creating specially formed DLL files. The vulnerability can be triggered without any user interaction, simply by opening a malicious email. Recommendations: For Microsoft Outlook versions prior to the fixed version, update to the latest version to resolve the issue. As a temporary workaround, consider disabling the auto-open email feature to minimize the risk of exploitation. Restrict access to vulnerable modules to minimize the risk of exploitation. Avoid using vulnerable parameters in affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.