Signature Detail

SMTP: Outlook Saved Search File

This signature detects Outlook Saved Search Files sent through SMTP. Attackers can use a malformed OSS file to execute remote code against Microsoft Outlook. Versions 2000, 2002, and 2003 are vulnerable.

Extended Description

Microsoft Outlook is prone to a remote code-execution vulnerability because the application fails to properly handle malformed saved search files. A remote attacker can exploit this issue to execute arbitrary code with the privileges of unsuspecting users. A successful exploit may aid in the remote compromise of the underlying computer.

Affected Products

• Microsoft Office 2000 SP1
• Microsoft Office 2000 SP2
• Microsoft Office 2000 SP3
• Microsoft Office 2000
• Microsoft Office 2003 SP1
• Microsoft Office 2003 SP2
• Microsoft Office 2003
• Microsoft Office XP SP1
• Microsoft Office XP SP2
• Microsoft Office XP SP3
• Microsoft Office XP
• Microsoft Outlook 2000 SP2
• Microsoft Outlook 2000 SP3
• Microsoft Outlook 2000 SR1
• Microsoft Outlook 2000
• Microsoft Outlook 2002 SP1
• Microsoft Outlook 2002 SP2
• Microsoft Outlook 2002 SP3
• Microsoft Outlook 2002
• Microsoft Outlook 2003 SP2
• Microsoft Outlook 2003

References

• BugTraq: 21936
• CVE: CVE-2007-0034
• URL: http://www.microsoft.com/technet/security/Bulletin/MS07-003.mspx