[ SOURCE: http://www.secureroot.com/security/advisories/9678232530.html ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Vulnerability in vCard import in Outlook 2000 Released: August 30, 2000 Summary ======= Under certain conditions, excessively long or malformed fields in a vCard (.vcf) file can cause Microsoft Outlook 2000 to either overflow or excessively utilize system resources. Background ========== The specifications regarding vCard MIME types and field contents can be found in RFCs 2425 and 2426. Although RFC 2426 section 2.6 specifically requires lines longer than 75 characters to be folded as defined in [MIME-DIR], it appears Outlook does not support line folding, and will attempt to import any field in the file as one value, even if it is several pages long or (in one case) overflows a data field within Outlook. The effect this unlimited import attempt has on Outlook 2000 varies between field types. Some fields will cause Outlook to consume nearly all CPU time, and certain others (especially date/revision fields and e-mail fields) will cause Outlook to terminiate immediately due to an overflow. Severity ======== Outlook 2000 does not attempt to open and import a .vcf file that a user receives via e-mail without prompting the user first. However, vCard files are extremely common, and many users have trained themselves to ignore the warning dialog box. Outlook does, however, open a vCard file with no questions asked if the user saves it to a directory and double-clicks it from Windows Explorer. In this situation, the vCard is processed directly with no warning or status messages displayed to the user. Affected Configurations ======================= Microsoft Outlook 2000 was the only platform tested (on Windows NT 4.0 Workstation, Service Pack 6a+hotfixes). Affected fields in vCard file causing an overflow: - - email: - - bday; value=date (as low as 52 characters of form YYYY-MM-D(60) Affected fields in vCard file causing excessive CPU utilization: - - name: - - nickname: - - fn: - - title: - - title;language=de;value=text: - - tel: - - tel;