CVE-2000-0329

Description

A Microsoft ActiveX control allows a remote attacker to execute a malicious cabinet file via an attachment and an embedded script in an HTML mail, aka the "Active Setup Control" vulnerability.

Affected products

• microsoft / ie4.0 – 4.0
• microsoft / ie4.0 – 4.0
• microsoft / ie4.0.1 – 4.0.1
• microsoft / ie4.0.1 – 4.0.1
• microsoft / ie4.0.1 – 4.0.1
• microsoft / ie4.1 – 4.1
• microsoft / ie4.1 – 4.1
• microsoft / ie4.1 – 4.1
• microsoft / ie5 – 5
• microsoft / ie5.0 – 5.0
• microsoft / ie5.0 – 5.0
• microsoft / ie5.0 – 5.0
• microsoft / internet_explorer4.0 – 4.0
• microsoft / Outlook98 – 98
• microsoft / Outlook2000 – 2000
• microsoft / outlook_express4.27.3110.1 – 4.27.3110.1
• microsoft / outlook_express4.72.2106.4 – 4.72.2106.4
• microsoft / outlook_express4.72.3120.0 – 4.72.3120.0
• microsoft / outlook_express4.72.3612.1700 – 4.72.3612.1700
• microsoft / outlook_express5.0 – 5.0

Exploits & proofs of concept

• exploit-dbMicrosoft Internet Explorer 4.x/5 / Outlook 2000 0/98 0/Express 4.x - ActiveX '.CAB' File Executionby Mukund

References

• MISChttps://docs.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-048