CVE-2007-3897

Heap-based buffer overflow in Microsoft Outlook Express 6 and earlier, and Windows Mail for Vista, allows remote Network News Transfer Protocol (NNTP) servers to execute arbitrary code via long NNTP responses that trigger memory corruption.

CVSS v2.0 9.3 HIGH

9.3^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=607	Broken Link
http://www.us-cert.gov/cas/techalerts/TA07-282A.html	Third Party Advisory US Government Resource
http://www.securityfocus.com/bid/25908	Third Party Advisory VDB Entry
http://securitytracker.com/id?1018785	Third Party Advisory VDB Entry
http://securitytracker.com/id?1018786	Third Party Advisory VDB Entry
http://secunia.com/advisories/27112	Third Party Advisory
http://www.vupen.com/english/advisories/2007/3436	Permissions Required Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1706	Third Party Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-056	Patch Vendor Advisory
http://www.securityfocus.com/archive/1/482366/100/0/threaded	Third Party Advisory VDB Entry
http://www.securityfocus.com/archive/1/481983/100/100/threaded	Third Party Advisory VDB Entry

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:microsoft:outlook_express:6.0:sp1::::::
	cpe:2.3:a:microsoft:outlook_express::::::::
	cpe:2.3:a:microsoft:windows_mail:-:::::vista::

Information

Published : 2007-10-09 15:17

Updated : 2019-10-09 15:53

NVD link : CVE-2007-3897

Mitre link : CVE-2007-3897

JSON object : View

CWE

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Advertisement

Products Affected

microsoft

outlook_express
windows_mail

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=607", "name": "20071009 Microsoft Windows Mail and Outlook Express NNTP Protocol Heap Overflow", "tags": ["Broken Link"], "refsource": "IDEFENSE"}, {"url": "http://www.us-cert.gov/cas/techalerts/TA07-282A.html", "name": "TA07-282A", "tags": ["Third Party Advisory", "US Government Resource"], "refsource": "CERT"}, {"url": "http://www.securityfocus.com/bid/25908", "name": "25908", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "BID"}, {"url": "http://securitytracker.com/id?1018785", "name": "1018785", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "SECTRACK"}, {"url": "http://securitytracker.com/id?1018786", "name": "1018786", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "SECTRACK"}, {"url": "http://secunia.com/advisories/27112", "name": "27112", "tags": ["Third Party Advisory"], "refsource": "SECUNIA"}, {"url": "http://www.vupen.com/english/advisories/2007/3436", "name": "ADV-2007-3436", "tags": ["Permissions Required", "Third Party Advisory"], "refsource": "VUPEN"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1706", "name": "oval:org.mitre.oval:def:1706", "tags": ["Third Party Advisory"], "refsource": "OVAL"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-056", "name": "MS07-056", "tags": ["Patch", "Vendor Advisory"], "refsource": "MS"}, {"url": "http://www.securityfocus.com/archive/1/482366/100/0/threaded", "name": "HPSBST02280", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "HP"}, {"url": "http://www.securityfocus.com/archive/1/481983/100/100/threaded", "name": "20071010 Re: iDefense Security Advisory 10.09.07: Microsoft Windows Mail and Outlook Express NNTP Protocol Heap Overflow", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Heap-based buffer overflow in Microsoft Outlook Express 6 and earlier, and Windows Mail for Vista, allows remote Network News Transfer Protocol (NNTP) servers to execute arbitrary code via long NNTP responses that trigger memory corruption."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-119"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2007-3897", "ASSIGNER": "secure@microsoft.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "severity": "HIGH", "impactScore": 10.0, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2007-10-09T22:17Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:microsoft:outlook_express:6.0:sp1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:outlook_express:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "6.0"}, {"cpe23Uri": "cpe:2.3:a:microsoft:windows_mail:-:*:*:*:*:vista:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2019-10-09T22:53Z"}