Secunia CSI7
Advisories
Research
Forums
Create Profile
Our Commitment
Database
Search
Advisories by Product
Advisories by Vendor
Terminology
Report Vulnerability
Insecure Library Loading
Highly critical

Microsoft Office Multiple Code Execution Vulnerabilities

-

Release Date:  2006-03-14    Last Update:  2008-05-15    Views:  33,334

Secunia Advisory SA19138

Where:

From remote

Impact:

System access

Solution Status:

Vendor Patch

CVE Reference(s):

Description


Multiple vulnerabilities have been reported in Microsoft Office, which can be exploited by malicious people to compromise a user's system.

1) A boundary error in Excel when processing files with a malformed "Named Range" with negative length values can be exploited to corrupt memory and allows execution of arbitrary code on a user's system when viewing a specially crafted Excel file.

2) A boundary error in Office when processing documents containing a specially crafted "routing slip" can be exploited to corrupt memory and allows execution of arbitrary code on a user's system when the user views and closes a malicious document.

3) An error in Excel when parsing the BIFF file format can be exploited via malformed BOOLERR records to corrupt memory. This allows execution of arbitrary code on a user's system when viewing a specially crafted Excel file.

4) A boundary error in Excel when processing a specially crafted file with an overly large formula size can be exploited to cause a stack-based buffer overflow and allows execution of arbitrary code on a user's system when a malicious Excel file is viewed. An error within the handling of the "Column Index" read from an Excel file can cause Excel to crash due to invalid memory access.

5) An error in Excel when processing malformed graphics can be exploited to corrupt memory and allows execution of arbitrary code on a user's system when viewing a specially crafted Excel file.

6) A boundary error in Excel when processing malformed records with a specially-crafted length value can be exploited to corrupt stack memory and may allow execution of arbitrary code on a user's system when viewing a malicious Excel file.


Solution:
Apply patches.

Further details available to Secunia VIM customers

Provided and/or discovered by:
1) Peter Winter-Smith of NGSSoftware (the vendor also credits FelicioX).
2) The vendor credits Ollie Whitehouse, Symantec.
3) Arnaud Dovi
4) Dejun Meng, Fortinet Security Response Team.
5) Reported by vendor.
6) The vendor credits Eyas, XFOCUS Security Team.

Original Advisory:
MS06-012 (KB905413):
http://www.microsoft.com/technet/security/Bulletin/MS06-012.mspx

Zero Day Initiative:
http://www.zerodayinitiative.com/advisories/ZDI-06-004.html

HexView:
http://www.hexview.com/docs/20060314-1.txt

XFOCUS Security Team:
http://lists.grok.org.uk/pipermail/full-disclosure/2006-March/043660.html

Symantec:
http://www.symantec.com/enterprise/research/SYMSA-2006-001.txt

Fortinet:
http://www.fortiguardcenter.com/advisory/FGA-2006-11.html
http://www.fortiguardcenter.com/advisory/FGA-2006-12.html

Deep Links:
Links available to Secunia VIM customers

Do you have additional information related to this advisory?

Please provide information about patches, mitigating factors, new versions, exploits, faulty patches, links, and other relevant data by posting comments to this Advisory. You can also send this information to vuln@secunia.com

Subject: Microsoft Office Multiple Code Execution Vulnerabilities

No posts yet

-

You must be logged in to post a comment.



 Products Solutions Customers Partner Resources Company
 
 Corporate
Vulnerability Intelligence Manager (VIM)
Corporate Software Inspector (CSI)
Consumer
Personal Software Inspector (PSI)
Online Software Inspector (OSI)
 Industry
Compliance
Technology
Integration
 Customers
Testimonials
 VARS
MSSP
Technology Partners
References
 Factsheets
Reports
Webinars
Events
 About us
Careers
Memberships
Newsroom


 
© 2002-2014 Secunia ApS - Rued Langgaards Vej 8, 4th floor, DK-2300 Copenhagen, Denmark - +45 7020 5144
Terms & Conditions and Copyright - Privacy - Report Vulnerability