Argument injection in Microsoft Outlook enables arbitrary program execution

Argument injection vulnerability in Microsoft Outlook 2002 does not sufficiently filter parameters of mailto: URLs when using them as arguments when calling OUTLOOK.EXE, which allows remote attackers to use script code in the Local Machine zone and execute arbitrary programs.

• Microsoft Office XP SP2: affected according to the normalized record and Microsoft's bulletin.
• Microsoft Outlook 2002 SP2: affected. Outlook may be installed separately or as part of Office XP.
• Microsoft Office XP SP3: Microsoft states that the update is included in this branch and that systems with this branch do not need additional action for this issue.
• Microsoft Outlook 2002 SP3: listed by Microsoft as not affected.
• Microsoft also lists Office 2000 SP3, Office 2003, Outlook 2000 SP3, and Outlook 2003 as not affected within the tested software list.
• Outlook Express is not itself affected, but it can participate in the attack path when Outlook 2002 is configured as the default mail reader and a malicious HTML message is opened through Outlook Express.

Microsoft Outlook contains an argument injection flaw because it does not sufficiently filter mailto: URL parameters before passing them as arguments to OUTLOOK.EXE. A specially formatted URL can change how Outlook is invoked, allowing Internet Explorer to execute script in the Local Machine zone. An attacker can deliver the URL through a malicious webpage or a specially crafted HTML email, but the victim must visit the page or view the message to trigger the attack path. The confirmed sources do not establish the exact URL parser routine, a safe payload structure, or the remaining internal implementation details. Microsoft also updated its description to confirm that exposure was not limited to configurations using Outlook Today as the default folder home page.

The vulnerability is remotely reachable through web content or HTML email and does not require the attacker to authenticate to the target system. Exploitation requires the victim to visit a malicious webpage or view a specially crafted HTML message. The normalized record marks a public exploit as present, but the returned sources do not identify a specific exploit name, exploit code, campaign, victim, or observed exploitation indicator. CERT/CC records that the issue was publicly reported by Microsoft Security and iDefense. The absence of campaign details in the reviewed sources should not be treated as evidence that exploitation never occurred.

Successful exploitation can cause Internet Explorer to execute script in the Local Machine zone and can allow arbitrary programs to run on the user's workstation. The code runs in the security context of the logged-on account, so that account's permissions constrain the files and system resources the attacker can reach. Technical consequences may include file access, data modification, or execution of malicious software on the workstation. The flaw does not by itself establish administrator-level privilege escalation, network propagation, or compromise of other machines. The requirement for the user to view malicious content limits the attack path but does not remove the risk from web-browsing and HTML-mail workflows.

• An exploited workstation may run attacker-selected code with the privileges of the logged-on user.
• That code may access local files and execute programs, creating risks to user data, workstation configuration, and business tooling.
• The level of impact depends on the account's privileges. A low-privilege account limits the result compared with an account operating with administrative rights.
• HTML email and web-browsing workflows can both provide an entry path, so controlling only one channel may not be sufficient.
• The record does not establish evidence of lateral movement to other systems or a specific data breach.

1. Deploy Microsoft Security Bulletin MS04-009, update KB828040, to affected Microsoft Office XP SP2 or Microsoft Outlook 2002 SP2 installations.
2. Upgrade Office XP to Service Pack 3 where applicable, because Microsoft confirms that the update is included in that branch. Do not infer the status of other branches without separate verification.
3. If patching is not immediately possible, disable the Outlook Today folder home page by clearing Show home page by default for this folder for the relevant folders. This only reduces a documented attack path and removes the Outlook Today home-page functionality.
4. For Outlook 2002 installations with Service Pack 1 or later in the relevant branch, enable plain-text reading for unsigned or unencrypted messages to reduce exposure to HTML email. This removes some rich content and does not correct the mailto: parsing flaw.
5. After deployment, verify the update on each workstation and recheck the default mail-reader, Outlook Today, and HTML-rendering settings.

1. Inventory workstations that contain Microsoft Office or Outlook and record the installed release and service-pack level, then compare them with the affected and remediated branches in affected_summary.
2. Verify that Microsoft security update KB828040, or the corresponding Microsoft update, is installed on systems in an affected branch.
3. Review Outlook settings related to Outlook Today and determine whether Outlook is registered as the default mail reader.
4. Review HTML-mail handling policy, especially whether messages are read in plain text. This reduces one email attack path but does not correct the underlying parsing flaw.
5. As a precaution, review endpoint telemetry for Outlook launching programs or scripts, or accessing files unexpectedly around the time a user opened HTML email or visited a webpage. These are generic hunting signals, not confirmed IOCs for this vulnerability.
6. No specific log signature or IOC is established by the reviewed sources. The absence of suspicious events does not prove that a system is safe.