Title

Include the Internet with Safe Zones for Picture Download - Outlook (Cat II impact)

Discussion

Malicious e-mail senders can send HTML e-mail messages with embedded Web beacons, which are pictures and other content from external servers that can be used to track whether recipients open the messages. Viewing e-mail messages that contain Web beacons provides confirmation that the recipient's e-mail address is valid, which leaves the recipient vulnerable to additional spam and harmful e-mail. By default, Outlook 2007 does not download external content in HTML e-mail messages from untrusted senders via the Internet. If this configuration is changed, Outlook will display external content in all HTML e-mail messages received from the Internet, which could include Web beacons.

Check Content

The intent of this requirement (DTOO274) is to prevent content from the Internet from being automatically downloaded. This requirement (DTOO274) is coupled with DTOO272 which dictates whether content from Safe Zones is automatically downloaded or not. Since DTOO272 allows for content from Safe Zones to be automatically downloaded, this requirement (DTOO274) prevents the Internet from being considered as a Safe Zone. Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office Outlook 2007 >> Security >> Automatic Picture Download Settings “Include Internet in Safe Zones for Automatic Picture Download” is set to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\12.0\Outlook\Options\Mail Criteria: If the value Internet is REG_DWORD = 0, this is not a finding.

Fix Text

The policy value for User Configuration >> Administrative Templates >> Microsoft Office Outlook 2007 >> Security >> Automatic Picture Download Settings “Include Internet in Safe Zones for Automatic Picture Download” will be set to “Disabled”.

Additional Identifiers

Rule ID: SV-18775r4_rule

Vulnerability ID: V-17630

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.