Heap-based buffer overflow in Microsoft Outlook Express 6 and earlier, and Windows Mail for Vista, allows remote Network News Transfer Protocol (NNTP) servers to execute arbitrary code via long NNTP responses that trigger memory corruption.

Arbitrary code can be executed on the remote host through the email client.  The remote host is running a version of Microsoft Outlook Express that contains several security flaws that may allow an attacker to execute arbitrary code on the remote host.  To exploit this flaw, an attacker would need to send a malformed email to a victim on the remote host and have him open it.

The remote host is running a version of Microsoft Outlook Express that contains several security flaws that could allow an attacker to execute arbitrary code on the remote host.

To exploit this flaw, an attacker would need to send a malformed email to a victim on the remote host and have him open it.

ID	Name	Product	Family	Severity
4236	Cumulative Security Update for Microsoft Outlook Express and Windows Mail (941202)	Nessus Network Monitor	SMTP Clients	medium
4235	Cumulative Security Update for Microsoft Outlook Express and Windows Mail (941202)	Nessus Network Monitor	SMTP Clients	medium
4234	Cumulative Security Update for Microsoft Outlook Express and Windows Mail (941202)	Nessus Network Monitor	SMTP Clients	medium
4233	Cumulative Security Update for Microsoft Outlook Express and Windows Mail (941202)	Nessus Network Monitor	SMTP Clients	medium
4232	Cumulative Security Update for Microsoft Outlook Express and Windows Mail (941202)	Nessus Network Monitor	SMTP Clients	medium
26962	MS07-056: Cumulative Security Update for Outlook Express and Windows Mail (941202)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2007-3897

critical

Tenable Plugins

medium

medium

medium

medium

medium

high