0patch fixes Memory Corruption vulnerability (CVE-2022-35742) in Microsoft Outlook 2010Born's Tech and Windows World

[German]The vulnerability CVE-2022-35742 in Outlook was closed by Microsoft in August 2022 by means of security updates (see Patchday: Microsoft Office Updates (August 9, 2022)). However, Microsoft only provides updates for the MSI versions of Outlook 2013 and 2016. ACROS Security has now released a micropatch that closes the vulnerability in Microsoft Outlook 2010.

Advertising

The vulnerability, fixed in Microsoft Outlook August 2022, was discovered by security researcher insu from 78ResearchLab, as Mitja Kolsek writes here. The vulnerability exploits an error in Outlook's processing of multiple Content-Type headers in a multipart/signed email. A malicious email could cause an unallocated memory address to be shared and Outlook to crash while such an email is being downloaded (even before it is displayed to the user).

It is enough to click on the mail in the user's inbox or view its contents in the preview window. Microsoft classifies this as a "denial of service" vulnerability. According to Kolsek, however, it is not impossible that the vulnerability can be exploited to execute arbitrary code.

While Microsoft Office 2013 and 2019 have still received updates and the Click2-Run variants have also been updated, Microsoft Office 2010 and thus Outlook 2010 has fallen out of support. According to the above tweet, ACROS Security is already providing a micropatch that closes the vulnerability in Microsoft Outlook 2010.

The micropatch is available for both 32-bit and 64-bit versions of Outlook 2010, but requires Outlook to be at the April 2021 update level. This micropatch has already been distributed to all online 0patch agents with a PRO or Enterprise license, as Mitja Kolsek writes here. Notes on how the 0patch agent works, which loads the micropatches into memory at an application's runtime, can be found in blog posts (such as here).

Advertising

an alle Online-0patch-Agenten mit einer PRO- oder Enterprise-Lizenz verteilt, wie Mitja Kolsek hier schreibt. Hinweise zur Funktionsweise des 0patch-Agenten, der die Micropatches zur Laufzeit einer Anwendung in den Speicher lädt, finden Sie in den Blog-Posts (wie z.B. hier).

Advertising

0patch fixes Memory Corruption vulnerability (CVE-2022-35742) in Microsoft Outlook 2010

Leave a Reply Cancel reply

Blogs

Links

Social networks

Awards

Sponsors

Recent Comments

Recent Comments

Meta