Outlook and OWA Subject to From Field Spoofing

Reported April 11, 2005 by iDEFENSE

VERSIONS AFFECTED

Microsoft Outlook (not Microsoft Outlook Express)
Microsoft Outlook Web Access (OWA)

DESCRIPTION

Due to the way Outlook and OWA parse From header fields, it's possible to change the field so that the email message appears to come from a different address.

WORKAROUND

Examine all the message's header fields to determine who a message actually came from.

VENDOR RESPONSE

iDEFENSE reports that Microsoft said it might implement a fix in a future service pack but that a security bulletin won't be released for this issue.

Comments

Plain text