cbcvebase.
CVE-2005-1213
published 2005-06-14

CVE-2005-1213: Stack-based buffer overflow in the news reader for Microsoft Outlook Express (MSOE.DLL) 5.5 SP2, 6, and 6 SP1 allows remote malicious NNTP servers to execute…

PriorityP356high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
73.96%
99.4th percentile
Stack-based buffer overflow in the news reader for Microsoft Outlook Express (MSOE.DLL) 5.5 SP2, 6, and 6 SP1 allows remote malicious NNTP servers to execute arbitrary code via a LIST response with a long second field.

Affected

2 ranges
VendorProductVersion rangeFixed in
microsoftoutlook_express
microsoftoutlook_express

Detection & IOCsextracted from sources · hover to see the quote

port119
port119
other0x7803382b
other0x75022ac4
other0x71aa2461
command215 list\r\ngroup
command215 list\r\ngroup
bytes
\x31\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x96\x27\xc8\x3e
bytes
\xEB\x06\xEB\x06
  • Exploit triggers via a malicious NNTP server sending a crafted LIST response; monitor for inbound NNTP connections (TCP/119) from external/untrusted hosts to client machines running Outlook Express.
  • The exploit payload begins with the NNTP response '215 list' followed by 'group' and a large padding buffer; detect anomalously long NNTP LIST responses (>9500 bytes in the second field) on TCP/119.
  • The exploit uses SEH-based overwrite with alphanumeric-upper encoded payload; look for alphanumeric shellcode patterns immediately following the oversized NNTP LIST group field.
  • The standalone PoC exploit listens on TCP/119 and sends the overflow after receiving two client requests; the evil buffer offset is 0x2598+0x200 (approximately 10136) bytes before appending shellcode.
  • The PoC shellcode opens a bind shell on TCP/4444 (LPORT=4444); monitor for unexpected listening sockets on port 4444 on Windows hosts running Outlook Express after NNTP activity.
  • ·The Metasploit module targets only Windows 2000 SP0-SP4 and Windows XP SP0/SP1; the return addresses and offsets are platform-specific and will differ for other OS versions or service packs.
  • ·The standalone PoC only includes a return address for Windows 2000 SP4 (all languages); exploitation against other targets requires a different JMP EBX gadget address.
  • ·The Metasploit payload space is limited to 750 bytes with no null bytes allowed and requires alphanumeric-upper encoding; payloads exceeding these constraints or containing null bytes will fail.
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.