CVE-2004-0526: Medium severity Microsoft Outlook vulnerability

Published Jun 8, 2004

Updated

Unknown versions of Internet Explorer and Outlook allow remote attackers to spoof a legitimate URL in the status bar via A HREF tags with modified "alt" values that point to the legitimate site, combined with an image map whose href points to the malicious site, which facilitates a "phishing" attack.

Affected Software

32 affected components

Microsoft Outlook=2000-sr1

Microsoft Outlook Express=5.0.1

Microsoft Outlook=2000

Microsoft ie=6.0-sp1

Microsoft Outlook Express=5.0

Microsoft Outlook Express=4.72.3612

Microsoft Outlook=2000-sp3

Microsoft Outlook=2003

Microsoft Outlook Express=4.72.3120.0

Microsoft Outlook=2002-sp2

Microsoft Outlook=2002-sp3

Microsoft Outlook Express=4.27.3110

Microsoft Outlook Express=4.72.2106

Microsoft Outlook Express=4.0

Microsoft Outlook Express=6.0

Microsoft Outlook=98

Microsoft Outlook Express=5.5

Microsoft Outlook=2002-sp1

Microsoft Outlook Express=4.01-sp2

Microsoft Outlook=2000-sp2

Microsoft Outlook=2002

Microsoft Outlook=97

Microsoft Internet Explorer=5.5-sp2

Microsoft Internet Explorer=5.0

Microsoft Internet Explorer=5.0.1

Microsoft Internet Explorer=5.0.1-sp2

Microsoft Internet Explorer=5.0.1-sp3

Microsoft Internet Explorer=5.0.1-sp4

Microsoft Internet Explorer=5.0.1-sp1

Microsoft Internet Explorer=5.5

Microsoft Internet Explorer=5.5-sp1

Microsoft Internet Explorer=6.0

Event History

Jun 8, 2004

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2004-0526?

CVE-2004-0526 is classified as a medium severity vulnerability that allows for phishing attacks via URL spoofing.

How do I fix CVE-2004-0526?

To mitigate CVE-2004-0526, users should update to the latest versions of Internet Explorer or Outlook that address this vulnerability.

What types of attacks are possible with CVE-2004-0526?

CVE-2004-0526 enables attackers to conduct phishing attacks by spoofing legitimate URLs in the status bar.

Which software is affected by CVE-2004-0526?

CVE-2004-0526 affects several versions of Internet Explorer and Microsoft Outlook, including versions 5.0 through 6.0.

Is CVE-2004-0526 still a concern today?

While CVE-2004-0526 targets older software versions, it serves as an example of the importance of using up-to-date software for security.