CVE-2006-0002
UnknownEPSS 45.58%
Last modified
CVE-2006-0002 is a vulnerability of currently unknown severity. Unspecified vulnerability in Microsoft Outlook 2000 through 2003, Exchange 5.0 Server SP2 and 5.5 SP4, Exchange 2000 SP3, and Office allows remote attackers to execute arbitrary code via an e-mail message with a crafted Transport Neutral Encapsulation Format (TNEF) MIME attachment, related to message length validation.. EPSS estimates a 45.58% chance of exploitation in the next 30 days.
Description
Unspecified vulnerability in Microsoft Outlook 2000 through 2003, Exchange 5.0 Server SP2 and 5.5 SP4, Exchange 2000 SP3, and Office allows remote attackers to execute arbitrary code via an e-mail message with a crafted Transport Neutral Encapsulation Format (TNEF) MIME attachment, related to message length validation.
Metrics
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Microsoft | Exchange Server | 5.0 | — |
| Microsoft | Exchange Server | 5.5 | — |
| Microsoft | Exchange Server | 2000 | Sp3 |
| Microsoft | Office | 2000 | Sp3 |
| Microsoft | Office | 2003 | Sp1 |
| Microsoft | Office | xp | Sp3 |
| Microsoft | Outlook | 2000 | Sp3 |
| Microsoft | Outlook | 2002 | Sp3 |
| Microsoft | Outlook | 2003 | — |
References
- http://secunia.com/advisories/18368Patch, Third Party Advisory
- http://securityreason.com/securityalert/330Third Party Advisory
- http://securityreason.com/securityalert/331Third Party Advisory
- http://securitytracker.com/id?1015460Patch, Third Party Advisory, VDB Entry
- http://securitytracker.com/id?1015461Patch, Third Party Advisory, VDB Entry
- http://support.avaya.com/elmodocs2/security/ASA-2006-004.htmThird Party Advisory
- http://www.kb.cert.org/vuls/id/252146Third Party Advisory, US Government Resource
- http://www.securityfocus.com/archive/1/421518/100/0/threadedThird Party Advisory, VDB Entry
- http://www.securityfocus.com/archive/1/421520/100/0/threadedThird Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/16197Patch, Third Party Advisory, VDB Entry
- http://www.us-cert.gov/cas/techalerts/TA06-010A.htmlPatch, Third Party Advisory, US Government Resource
- http://www.vupen.com/english/advisories/2006/0119Permissions Required
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-003Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/22878Third Party Advisory, VDB Entry
- http://secunia.com/advisories/18368Patch, Third Party Advisory
- http://securityreason.com/securityalert/330Third Party Advisory
- http://securityreason.com/securityalert/331Third Party Advisory
- http://securitytracker.com/id?1015460Patch, Third Party Advisory, VDB Entry
- http://securitytracker.com/id?1015461Patch, Third Party Advisory, VDB Entry
- http://support.avaya.com/elmodocs2/security/ASA-2006-004.htmThird Party Advisory
- http://www.kb.cert.org/vuls/id/252146Third Party Advisory, US Government Resource
- http://www.securityfocus.com/archive/1/421518/100/0/threadedThird Party Advisory, VDB Entry
- http://www.securityfocus.com/archive/1/421520/100/0/threadedThird Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/16197Patch, Third Party Advisory, VDB Entry
- http://www.us-cert.gov/cas/techalerts/TA06-010A.htmlPatch, Third Party Advisory, US Government Resource
- http://www.vupen.com/english/advisories/2006/0119Permissions Required
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-003Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/22878Third Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2006-0002?
Unspecified vulnerability in Microsoft Outlook 2000 through 2003, Exchange 5.0 Server SP2 and 5.5 SP4, Exchange 2000 SP3, and Office allows remote attackers to execute arbitrary code via an e-mail message with a crafted Transport Neutral Encapsulation Format (TNEF) MIME attachment, related to message length validation.
How severe is CVE-2006-0002?
Severity scoring for CVE-2006-0002 is pending analysis. The EPSS model estimates a 45.58% probability of exploitation in the next 30 days.
How do I fix CVE-2006-0002?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2006
- CVE-2006-0001Stack-based buffer overflow in Microsoft Publisher 2000 thro…
- CVE-2006-0003Unspecified vulnerability in the RDS.Dataspace ActiveX contr…
- CVE-2006-0004Microsoft PowerPoint 2000 in Office 2000 SP3 has an interact…
- CVE-2006-0005Buffer overflow in the plug-in for Microsoft Windows Media P…
- CVE-2006-0006Heap-based buffer overflow in the bitmap processing routine …
- CVE-2006-0007Buffer overflow in GIFIMP32.FLT, as used in Microsoft Office…
- CVE-2006-0008The ShellAbout API call in Korean Input Method Editor (IME) …
Are you affected by CVE-2006-0002?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST