CVE-2005-1987

Vulnerability

A buffer overflow vulnerability exists in Microsoft Collaboration Data Objects (CDO), specifically in the cdosys.dll and cdoex.dll libraries. The flaw occurs when an application or component that uses CDO processes an email message with an excessively long header name, such as "Content-Type" followed by a large string. Affected software includes Microsoft Windows 2000 Service Pack 4, Windows XP Service Pack 1 and Service Pack 2, Windows XP Professional x64 Edition, Windows Server 2003 (including Service Pack 1), Windows Server 2003 for Itanium-based Systems, Windows Server 2003 x64 Edition, and Microsoft Exchange 2000 Server Service Pack 3 with the Exchange 2000 Post-Service Pack 3 Update Rollup of August 2004. Non-affected versions include Windows 98, Windows ME, Exchange Server 5.5, and Exchange Server 2003 (including Service Pack 1). [1][2][3]

Exploitation

An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted email message to a vulnerable system that uses CDO to parse email content, such as Microsoft Exchange 2000 Server with event sinks enabled or Internet Information Services (IIS) with CDO components. The email contains a header with an abnormally long name, which triggers a stack-based buffer overflow when the CDO library processes it. Proof-of-concept code for this vulnerability is publicly available. [2][3]

Impact

Successful exploitation allows the attacker to execute arbitrary code on the affected system with full system privileges, leading to complete compromise of the host. Additionally, the vulnerability can be used to bypass content security mechanisms, such as virus scanners and content filters, potentially allowing malicious content to evade detection. [1][2][3]

Mitigation

Microsoft released security update MS05-048 on October 11, 2005, which addresses this vulnerability. Customers should apply the appropriate update for their affected Windows or Exchange Server version at the earliest opportunity. As a workaround, administrators can disable event sinks on Exchange 2000 Server and IIS, or unregister the cdoex.dll and cdosys.dll files to reduce the attack surface. No other mitigations are available for systems that cannot be patched. [1][3]