Microsoft Outlook Zero-Click Security Flaws Triggered by Sound File

Always amazes me Microsoft stays in businesses..but that is my personal opinion..

Article by

Jai Vijayan, Contributing Writer December 19, 2023

Attackers can chain the vulnerabilities to gain full remote code execution.
Researchers this week disclosed details on two security vulnerabilities in Microsoft Outlook that, when chained together, give attackers a way to execute arbitrary code on affected systems without any user interaction. Unusually, both of them can be triggered using a sound file.

One of the flaws, tracked as CVE-2023-35384, is actually the second patch bypass that researchers at Akamai have uncovered for a critical privilege escalation vulnerability in Outlook that Microsoft first patched in March. The second flaw that Akamai disclosed this week (CVE-2023-36710) is a remote code execution (RCE) vulnerability in a feature of Windows Media Foundation, and it has to do with how Windows parses sound files.

“An attacker on the Internet can chain the vulnerabilities together to create a full, zero-click remote code execution (RCE) exploit against Outlook clients,” Akamai said in a two-part blog post this week.
Arbitrary Code Execution

Microsoft issued a patch for CVE-2023-35384 in August, after Akamai researchers contacted the company. The flaw stems from a security feature in Outlook not properly validating if a requested URL is in a local machine zone, intranet zone, or another trusted zone.

Attackers can trigger the vulnerability by sending an affected Outlook client an email reminder with a custom notification sound, according to Akamai. “An attacker can specify a UNC path that would cause the client to retrieve the sound file from any SMB server” on the Internet, instead of from a safe or trusted zone, the vendor added.

To trigger the second vulnerability, an attacker would use the first vulnerability to send a specially crafted email that downloads a malicious sound file from an attacker-controlled server.

“When the downloaded sound file is autoplayed … it can lead to code execution on the victim machine,” Akamai said.

According to Ben Barnea, security researcher at Akamai, an attacker can exploit both vulnerabilities individually or in a chained fashion. “While each one of them is a somewhat ‘weak’ vulnerability, by chaining them together against Outlook we achieved a powerful zero-click RCE vulnerability,” he says.
Patch, Then Patch Again

As noted, this is the second time that Akamai researchers have found a way around a March patch that Microsoft issued for the Outlook privilege-escalation flaw tracked as CVE-2023-23397. That original bug gives attackers a way to use a sound file to steal a user’s password hash and authenticate to services to which the user has access. As recently as Dec. 4, Microsoft warned of Russia’s Fancy Bear group (aka Forest Blizzard) actively exploiting the flaw to gain unauthorized access to email accounts in Exchange server.

Microsoft’s original patch sought to ensure that before Outlook handles emails containing custom notification reminders, it first verifies the safety of the URL for the sound file. The patch was designed to ensure that if the URL for the custom notification sound was brought in from an untrusted/unverified domain, Outlook’s default notification sound is used instead.

But then, Akamai researchers probing the patch discovered they could bypass it by adding a single character to a function in the Microsoft update. The discovery prompted Microsoft to assign the issue a separate CVE (CVE-2023-29324) and issue a patch for it in May.

The new bypass that Akamai is detailing this week also arises from an issue in the original patch — and it might not be the last problem found in the patch, either.

“The patch for the original vulnerability used a function called ‘MapUrlToZone’ to mitigate the abuse of the custom reminder sound feature,” explains Barnea, noting that the function is a complex one and increases the attack surface available to the attacker.

“As a result, the patch added more code that also had vulnerabilities in it,” he says. “We suggested to remove the abused feature instead of using patches, since the feature does more harm than good.”

Article (

Roy Miehe | MspPortal Partners Inc. | Ceo/President

Security Software Distributor: Bitdefender , Barracuda, Axcient

“Where Service and Technical Skills Count”

Lock up inbound mail From

If you use Barracuda with MspPortal Partners do the following if you have not already done so



Customers Using the Following Instances of Email Gateway Defense
Network Traffic to Email Gateway Defense (SMTP) Network Traffic from Email Gateway Defense (SMTP and other)
Australia (AU)
Canada (CA)
Germany (DE)
United Kingdom (UK)
United States (US) / 21 / 20
Ensure Connectivity and Redundancy

Follow these tips to ensure connectivity and redundancy:

Open your firewall ports to allow the IP address ranges, based on your Barracuda Networks instance.
(Optional) Configure your mail server or router to block inbound email not originating from your Email Gateway Defense IP address ranges.
If you have a Barracuda Web Security Gateway or Barracuda Web Application Firewall: You might need to exempt from filtering.
Exempt traffic coming from Email Gateway Defense IP addresses from any kind of throttle or rate controls, RBL, and SPF or DKIM scanning.


Roy Miehe | MspPortal Partners Inc. | Ceo/President

Security Software Distributor: Bitdefender , Barracuda, Axcient

“Where Service and Technical Skills Count”


Bitdefender- New Content Policy

Bitdefender Modified the existing content filter in November

Network Attack Defense

Key is to be in Partner Mode

The Network Attack Defense module relies on a Bitdefender technology that focuses on detecting network attacks designed to gain access on endpoints through specific techniques, such as: brute-force attacks, network exploits, password stealers, drive-by-download infection vectors, bots, and Trojans.

Short Version
From the latest updates, the Web rules list found in Content Control > Web Access Control Settings > Web Categories Filter has been moved under Policies > Configuration Profiles > Web Access Control Scheduler > Category Scheduler.
You can now create new schedules with multiple time window settings and assign categories to each schedule. The categories will be removed from the policy and the new schedule will be mapped to a policy.

Please refer to this article ( from our documentation regarding how to create a scheduler and also assign it to a policy. Note that a scheduler can be assigned to more policies simultaneously.

Long Version

If you need assistance contact me

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, Axcient
“Where Service and Technical Skills Count”