CVE-2001-1088 (GCVE-0-2001-1088)

Vulnerability from cvelistv5 – Published: 2002-06-25 04:00 – Updated: 2024-08-08 04:44
VLAI?
Summary
Microsoft Outlook 8.5 and earlier, and Outlook Express 5 and earlier, with the "Automatically put people I reply to in my address book" option enabled, do not notify the user when the "Reply-To" address is different than the "From" address, which could allow an untrusted remote attacker to spoof legitimate addresses and intercept email from the client that is intended for another user.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-08T04:44:07.407Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20010605 SECURITY.NNOV: Outlook Express address book spoofing",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/188752"
          },
          {
            "name": "outlook-address-book-spoofing(6655)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/6655"
          },
          {
            "name": "2823",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/2823"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.microsoft.com/default.aspx?scid=kb%3BEN-US%3Bq234241"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2001-06-05T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Microsoft Outlook 8.5 and earlier, and Outlook Express 5 and earlier, with the \"Automatically put people I reply to in my address book\" option enabled, do not notify the user when the \"Reply-To\" address is different than the \"From\" address, which could allow an untrusted remote attacker to spoof legitimate addresses and intercept email from the client that is intended for another user."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2002-03-22T10:00:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20010605 SECURITY.NNOV: Outlook Express address book spoofing",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/188752"
        },
        {
          "name": "outlook-address-book-spoofing(6655)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/6655"
        },
        {
          "name": "2823",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/2823"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.microsoft.com/default.aspx?scid=kb%3BEN-US%3Bq234241"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2001-1088",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Microsoft Outlook 8.5 and earlier, and Outlook Express 5 and earlier, with the \"Automatically put people I reply to in my address book\" option enabled, do not notify the user when the \"Reply-To\" address is different than the \"From\" address, which could allow an untrusted remote attacker to spoof legitimate addresses and intercept email from the client that is intended for another user."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20010605 SECURITY.NNOV: Outlook Express address book spoofing",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/188752"
            },
            {
              "name": "outlook-address-book-spoofing(6655)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/6655"
            },
            {
              "name": "2823",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/2823"
            },
            {
              "name": "http://support.microsoft.com/default.aspx?scid=kb;EN-US;q234241",
              "refsource": "CONFIRM",
              "url": "http://support.microsoft.com/default.aspx?scid=kb;EN-US;q234241"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2001-1088",
    "datePublished": "2002-06-25T04:00:00",
    "dateReserved": "2002-03-15T00:00:00",
    "dateUpdated": "2024-08-08T04:44:07.407Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:microsoft:outlook:97:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D1D5CC3A-E880-4727-AEBE-1E4FE5A43AF8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:microsoft:outlook:98:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"52970A43-173E-477B-80BF-6FDBB6B0EECD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:microsoft:outlook:2000:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D52F17AB-2C87-4C1A-91B5-267ABBCF5844\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:microsoft:outlook_express:4.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6764F97F-6906-4953-BB1C-AA6345FA8FBE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:microsoft:outlook_express:4.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"67AB674C-70E1-4CCB-8F88-0741AAE6DA6E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:microsoft:outlook_express:4.27.3110:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3A5A497C-D03E-4666-BFCE-632F9943DB96\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:microsoft:outlook_express:4.72.2106:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5D635E46-B428-498D-9C6C-7CA9EB397C96\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:microsoft:outlook_express:4.72.3120.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7769EE2E-A740-4AE8-B1B1-A5256C12601D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:microsoft:outlook_express:4.72.3612:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F6C57670-B009-4C06-BAFD-B5212750F298\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:microsoft:outlook_express:5.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1F71D6D7-6CB2-4BE9-839A-A5714144029C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:microsoft:outlook_express:5.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"57C8ACA2-A3C6-4435-9C0C-B316879FE1FA\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Microsoft Outlook 8.5 and earlier, and Outlook Express 5 and earlier, with the \\\"Automatically put people I reply to in my address book\\\" option enabled, do not notify the user when the \\\"Reply-To\\\" address is different than the \\\"From\\\" address, which could allow an untrusted remote attacker to spoof legitimate addresses and intercept email from the client that is intended for another user.\"}]",
      "id": "CVE-2001-1088",
      "lastModified": "2024-11-20T23:36:50.780",
      "metrics": "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:N/C:P/I:P/A:P\", \"baseScore\": 7.5, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"HIGH\", \"exploitabilityScore\": 10.0, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": true, \"userInteractionRequired\": false}]}",
      "published": "2001-06-05T04:00:00.000",
      "references": "[{\"url\": \"http://support.microsoft.com/default.aspx?scid=kb%3BEN-US%3Bq234241\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.securityfocus.com/archive/1/188752\", \"source\": \"cve@mitre.org\", \"tags\": [\"Exploit\", \"Vendor Advisory\"]}, {\"url\": \"http://www.securityfocus.com/bid/2823\", \"source\": \"cve@mitre.org\", \"tags\": [\"Exploit\", \"Vendor Advisory\"]}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/6655\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://support.microsoft.com/default.aspx?scid=kb%3BEN-US%3Bq234241\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.securityfocus.com/archive/1/188752\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Vendor Advisory\"]}, {\"url\": \"http://www.securityfocus.com/bid/2823\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Vendor Advisory\"]}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/6655\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-Other\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2001-1088\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2001-06-05T04:00:00.000\",\"lastModified\":\"2025-04-03T01:03:51.193\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Microsoft Outlook 8.5 and earlier, and Outlook Express 5 and earlier, with the \\\"Automatically put people I reply to in my address book\\\" option enabled, do not notify the user when the \\\"Reply-To\\\" address is different than the \\\"From\\\" address, which could allow an untrusted remote attacker to spoof legitimate addresses and intercept email from the client that is intended for another user.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":7.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":true,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:outlook:97:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D1D5CC3A-E880-4727-AEBE-1E4FE5A43AF8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:outlook:98:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"52970A43-173E-477B-80BF-6FDBB6B0EECD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:outlook:2000:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D52F17AB-2C87-4C1A-91B5-267ABBCF5844\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:outlook_express:4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6764F97F-6906-4953-BB1C-AA6345FA8FBE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:outlook_express:4.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"67AB674C-70E1-4CCB-8F88-0741AAE6DA6E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:outlook_express:4.27.3110:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3A5A497C-D03E-4666-BFCE-632F9943DB96\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:outlook_express:4.72.2106:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5D635E46-B428-498D-9C6C-7CA9EB397C96\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:outlook_express:4.72.3120.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7769EE2E-A740-4AE8-B1B1-A5256C12601D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:outlook_express:4.72.3612:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F6C57670-B009-4C06-BAFD-B5212750F298\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:outlook_express:5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1F71D6D7-6CB2-4BE9-839A-A5714144029C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:outlook_express:5.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"57C8ACA2-A3C6-4435-9C0C-B316879FE1FA\"}]}]}],\"references\":[{\"url\":\"http://support.microsoft.com/default.aspx?scid=kb%3BEN-US%3Bq234241\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/archive/1/188752\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/2823\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/6655\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://support.microsoft.com/default.aspx?scid=kb%3BEN-US%3Bq234241\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/archive/1/188752\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/2823\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/6655\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.