| Vulnerability Name: | CVE-2006-0027 (CCN-25556) | ||||||||||||||||
| Assigned: | 2005-11-30 | ||||||||||||||||
| Published: | 2006-05-09 | ||||||||||||||||
| Updated: | 2020-04-09 | ||||||||||||||||
| Summary: | Unspecified vulnerability in Microsoft Exchange allows remote attackers to execute arbitrary code via e-mail messages with crafted (1) vCal or (2) iCal Calendar properties. | ||||||||||||||||
| CVSS v3 Severity: | 7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
| ||||||||||||||||
| CVSS v2 Severity: | 7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
| ||||||||||||||||
| Vulnerability Type: | CWE-noinfo | ||||||||||||||||
| Vulnerability Consequences: | Gain Access | ||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2006-0027 Source: CCN Type: SA20029 Microsoft Exchange Server Calendar Vulnerability Source: SECUNIA Type: Third Party Advisory 20029 Source: CCN Type: SECTRACK ID: 1016048 Microsoft Exchange Error in Processing iCAL/vCAL Properties Lets Remote Users Execute Arbitrary Code Source: SECTRACK Type: Third Party Advisory, VDB Entry 1016048 Source: CCN Type: ASA-2006-099 Windows Security Updates for May 2006 - (MS06-018 - MS06-020) Source: CCN Type: NORTEL BULLETIN ID: 2008008958, Rev 1 Centrex IP Client Manager (CICM) response to Microsoft July security bulletin Source: CCN Type: US-CERT VU#303452 Microsoft Exchange fails to properly handle vCal and iCal properties Source: CERT-VN Type: Patch, Third Party Advisory, US Government Resource VU#303452 Source: CCN Type: Microsoft Security Bulletin MS06-019 Vulnerability in Microsoft Exchange Could Allow Remote Code Execution (916803) Source: CCN Type: Microsoft Security Bulletin MS07-026 Vulnerabilities in Microsoft Exchange Could Allow Remote Code Execution (931832) Source: CCN Type: Microsoft Security Bulletin MS08-039 Vulnerabilities in Outlook Web Access for Exchange Server Could Allow Elevation of Privilege (953747) Source: CCN Type: Microsoft Security Bulletin MS09-003 Vulnerabilities in Microsoft Exchange Could Allow Remote Code Execution (959239) Source: OSVDB Type: Broken Link 25338 Source: CCN Type: OSVDB ID: 25338 Microsoft Exchange Collaboration Data Objects Crafted Email Code Execution Source: BID Type: Third Party Advisory, VDB Entry 17908 Source: CCN Type: BID-17908 Microsoft Exchange Server Calendar Remote Code Execution Vulnerability Source: CCN Type: US-CERT Technical Cyber Security Alert TA06-129A Microsoft Windows and Exchange Server Vulnerabilities Source: CERT Type: Patch, Third Party Advisory, US Government Resource TA06-129A Source: VUPEN Type: Permissions Required ADV-2006-1743 Source: CCN Type: Internet Security Systems Protection Alert May 9, 2006 Microsoft Exchange Calendar Attachment Heap-based Overflow Source: MS Type: Patch, Vendor Advisory MS06-019 Source: XF Type: Third Party Advisory, VDB Entry exchange-calendar-code-execution(25556) Source: XF Type: UNKNOWN exchange-calendar-code-execution(25556) Source: OVAL Type: Third Party Advisory oval:org.mitre.oval:def:1818 Source: OVAL Type: Third Party Advisory oval:org.mitre.oval:def:1996 Source: OVAL Type: Third Party Advisory oval:org.mitre.oval:def:2035 | ||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||||||
| Oval Definitions | |||||||||||||||||
| |||||||||||||||||
| BACK | |||||||||||||||||