cbcvebase.
CVE-2010-0816
published 2010-05-12

CVE-2010-0816: Integer overflow in inetcomm.dll in Microsoft Outlook Express 5.5 SP2, 6, and 6 SP1; Windows Live Mail on Windows XP SP2 and SP3, Windows Vista SP1 and SP2…

PriorityP264critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
20.32%
97.2th percentile
Integer overflow in inetcomm.dll in Microsoft Outlook Express 5.5 SP2, 6, and 6 SP1; Windows Live Mail on Windows XP SP2 and SP3, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7; and Windows Mail on Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows remote e-mail servers and man-in-the-middle attackers to execute arbitrary code via a crafted (1) POP3 or (2) IMAP response, as demonstrated by a certain +OK response on TCP port 110, aka "Outlook Express and Windows Mail Integer Overflow Vulnerability."

Affected

2 ranges
VendorProductVersion rangeFixed in
microsoftoutlook_express——
microsoftoutlook_express——

Detection & IOCsextracted from sources · hover to see the quote

filenameinetcomm.dll↗
port110↗
command+OK 357913944 100 ↗
  • →Monitor for crafted POP3 or IMAP server responses containing anomalously large message size values (e.g., 357913944) in +OK responses on TCP port 110, which trigger the integer overflow in inetcomm.dll. ↗
  • →The exploit requires no authentication; a rogue server or MITM attacker sends a specially crafted +OK POP3 response to a connecting mail client. Detect unexpected inbound POP3 server responses (port 110) with extremely large octet-count values in the +OK line. ↗
  • →The vulnerability is triggered by the POP3 +OK response carrying an oversized message size field; inspect POP3 traffic for +OK responses where the message size value causes an integer overflow (values near or exceeding 2^32 boundaries, e.g., 357913944 * 100). ↗
  • ·The exploit PoC listens on TCP port 110 acting as a rogue POP3 server; detection should cover both direct rogue-server scenarios and man-in-the-middle interception of legitimate POP3 sessions. ↗
  • ·The vulnerability also affects IMAP responses, not only POP3; detection rules should be extended to cover IMAP traffic in addition to POP3 port 110. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.