(PVS) Signatures - Tenable Network Security

Solution: Microsoft has released a set of patches for Outlook Express and Windows Mail.
CVE-2007-3897
Cumulative Security Update for Microsoft Outlook Express and Windows Mail (941202)
PVS ID: 4236 FAMILY: SMTP Clients RISK: HIGH NESSUS ID:26962
Description: Arbitrary code can be executed on the remote host through the email client. The remote
host is running a version of Microsoft Outlook Express that contains several security flaws
that may allow an attacker to execute arbitrary code on the remote host. To exploit this
flaw, an attacker would need to send a malformed email to a victim on the remote host and
have him open it.
Solution: Microsoft has released a set of patches for Outlook Express and Windows Mail.
CVE-2007-3897
SQL-Ledger < 2.6.27 Multiple Fields SQL Injection
PVS ID: 4237 FAMILY: Web Servers RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a SQL injection attack.\n\nThe remote host
is running SQL-Ledger, a web-based double-entry accounting system. The version of
SQL-Ledger on the remote host contains a flaw in the way that it handles user-supplied
data to the 'invoice quantity' and 'sort' fields. An attacker exploiting this flaw would be able
to inject and run arbitrary SQL commands against the database server.
Solution: Upgrade to version 2.6.27 or higher.
CVE-2007-5372
Firebird Database < 2.0.3.12981 'fbserver.exe' Stack Overflow
PVS ID: 4238 FAMILY: Database RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a buffer overflow.\n\nThe remote host
appears to be running a Firebird database server version '%L'. This version of Firebird is
vulnerable to a stack overflow when processing specially malformed requests. An attacker
exploiting this flaw would only need the ability to send malformed packets to the
fbserver.exe process which listens on TCP port 3050 by default. Successful exploitation
would result in the attacker executing arbitrary code.
Solution: Upgrade to version 2.0.3.12981 or higher.
CVE-2007-4992
Passive Vulnerability Scanner (PVS) Signatures
IBM DB2 < 9 FixPak 3 / 8 FixPak 15 Multiple Vulnerabilities
PVS ID: 4239 FAMILY: Database RISK: HIGH NESSUS ID:25905
Family Internet Services 1102