Microsoft Outlook on Android Email input validation

Summaryinfo

A vulnerability has been found in Microsoft Outlook on Android and classified as critical. Affected is an unknown function of the component Email Handler. Performing a manipulation results in input validation. This vulnerability was named CVE-2019-1460. The attack may be initiated remotely. There is no available exploit. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability, which was classified as critical, was found in Microsoft Outlook on Android (Groupware Software) (the affected version unknown). This affects an unknown part of the component Email Handler. The manipulation with an unknown input leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages, aka 'Outlook for Android Spoofing Vulnerability'.

The weakness was presented 11/19/2019 as confirmed security update guide (Website). The advisory is shared at portal.msrc.microsoft.com. The public release was coordinated in cooperation with Microsoft. This vulnerability is uniquely identified as CVE-2019-1460 since 11/26/2018. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. The advisory points out:

A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages. An authenticated attacker could exploit the vulnerability by sending a specially crafted email message to a victim.

Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Groupware Software

Vendor

• Microsoft

Name

• Outlook

License

• commercial

Website

• Vendor: https://www.microsoft.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion