PT-2007-1529 · Microsoft · Outlook

Stuart Pearson · Published 2007-01-09 · Updated 2018-10-16 · CVE-2007-0034

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Outlook versions 2000 through 2003

Description A buffer overflow issue exists in the Advanced Search feature of Microsoft Outlook, allowing remote attackers to execute arbitrary code via a crafted Outlook Saved Searches (OSS) file. This triggers memory corruption when the file is parsed by Outlook.

Recommendations For Microsoft Outlook versions 2000 through 2003, consider disabling the Advanced Search feature until a patch is available. Restrict access to .oss files to minimize the risk of exploitation.

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2007-0034

Affected Products

Outlook

References · 18

• http://vupen.com/english/advisories/2007/0104 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-003 · Vendor Advisory
• http://securityfocus.com/archive/1/457274/100/0/threaded · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0034 · Security Note
• http://secunia.com/advisories/23674 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-0034 · Security Note
• http://securityfocus.com/archive/1/456589/100/0/threaded · Note
• http://securitytracker.com/id?1017488 · Note
• http://securityfocus.com/archive/1/archive/1/457274/100/0/threaded · Note
• http://securityfocus.com/bid/21936 · Note
• http://frsirt.com/english/advisories/2007/0104 · Note
• http://securityfocus.com/archive/1/archive/1/456589/100/0/threaded · Note
• http://computerterrorism.com/research/ct09-01-2007.htm · Note
• http://kb.cert.org/vuls/id/271860 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2007/MS07-003 · Note