CVE-2020-17119: 
vulnerability analysis and mitigation

Microsoft Outlook Information Disclosure Vulnerability (CVE-2020-17119) is a security flaw discovered in Microsoft Outlook's MSG file parsing functionality. The vulnerability was reported to Microsoft on September 18, 2020, and was publicly disclosed on December 11, 2020. This vulnerability affects multiple versions of Microsoft Outlook, including Outlook 2010, 2013, 2016, 2019, and Microsoft 365 Apps (ZDI Advisory).

The vulnerability exists within the parsing of MSG files and results from the lack of proper validation of user-supplied data, which can lead to an out-of-bounds read condition. This can result in a read past the end of an allocated buffer. The vulnerability has received varying CVSS scores: NIST assigned a CVSS v3.1 Base Score of 7.5 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, while Microsoft rated it at 6.5 (MEDIUM) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N (NVD).

When successfully exploited, this vulnerability allows remote attackers to disclose sensitive information on affected installations of Microsoft Outlook. The impact is limited to information disclosure, with no direct impact on system integrity or availability. However, attackers could potentially leverage this vulnerability in conjunction with other vulnerabilities to execute code in the context of the current process (ZDI Advisory).

The vulnerability requires user interaction to be exploited, specifically the target must visit a malicious page or open a malicious file. This requirement somewhat mitigates the ease of exploitation (ZDI Advisory).

Microsoft has released security updates to address this vulnerability. Users should apply the security update KB4486742 for affected versions of Outlook. The update is available through Microsoft Update, Microsoft Update Catalog, and as standalone packages for both 32-bit and 64-bit versions (Microsoft Support).