WORLDTECHMicrosoft patches Outlook flaw exploited to steal NTLM authentication data
Microsoft has issued a fix for a spoofing vulnerability in Outlook that was already being abused before any patch was available. According to GBHackers, the flaw allows an attacker to obtain Windows authentication information via a malicious message file.
How the flaw is triggered
No account or existing privileges are needed by the attacker. Instead, a message file is prepared and sent, and the recipient is induced to open it in an affected Outlook installation. Once that happens, Outlook may reach out to a network location the attacker controls, and the usual warning about external content does not appear.
Microsoft characterises the exposed data as the user's NTLMv2 hash rather than a plaintext password. Depending on the target environment and its protections, captured material of this kind can be used for offline password cracking or for live relay attacks.
Severity rating and weakness classification
As the assigning CNA, Microsoft rates the maximum severity as Moderate, even though attacks targeting the flaw have been confirmed. The company lists a CVSS 3.1 base score of 6.5 and a temporal score of 6.2.
The advisory maps the flaw to CWE-356. MITRE now describes the weakness as missing user interaction for a potentially unsafe action. Because the attack depends on the user opening the file, the report cautions against describing it as a zero-click attack.
Part of a wider pattern
The incident continues a pattern of Outlook credential theft involving unwanted connections to external servers. According to the report, earlier Outlook exploitation campaigns have also shown how leaked authentication responses can enable unauthorised access.
Open questions
- Which Outlook versions and installations are affected, and how many users were targeted?
- Has Microsoft said who is behind the observed attacks?