|
Microsoft Excel tre kode-eksekveringssårbarheder
|
|
|
|
|
Secunia Advisory:
|
SA25150
|
|
|
Udsendt:
|
2007-05-08
|
|
Sidste Opdt.:
|
2007-05-09
|
|
|
Kritisk:
|
Meget kritisk
|
|
Betydning:
|
Systemadgang
|
|
Hvor:
|
Fra Internet
|
|
Løsning Status:
|
Producent Patch
|
|
| Software: | Microsoft Excel 2000
Microsoft Excel 2002
Microsoft Excel 2003
Microsoft Excel Viewer 2003
Microsoft Office 2000
Microsoft Office 2003 Professional Edition
Microsoft Office 2003 Small Business Edition
Microsoft Office 2003 Standard Edition
Microsoft Office 2003 Student and Teacher Edition
Microsoft Office 2004 for Mac
Microsoft Office 2007
Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats
Microsoft Office Excel 2007
Microsoft Office XP
|
| | CVE reference: | CVE-2007-0215 (Secunia mirror)
CVE-2007-1203 (Secunia mirror)
CVE-2007-1214 (Secunia mirror)
|
|
|
Want to know the next time vulnerabilities are fixed in this product?
- Companies can be alerted via email and SMS! |
|
|
Beskrivelse:
Der er rapporteret tre sårbarheder i Microsoft Excel, som kan udnyttes af ondsindede personer til at kompromittere en brugers system.
1) En ikke-kontrolleret buffer under håndteringen af fejlbehæftede BIFF records kan udnyttes til at korrumpere hukommelse via en ondsindet fil indeholdende en specielt udformet Named Graph record.
2) En fejl under håndteringen af visse font-værdier i Excel-filer kan udnyttes til at korrumpere hukommelsen.
3) En fejl under håndteringen af filter records kan udnyttes til at korrumpere hukommelsen.
Succesfuld udnyttelse af sårbarhederne muliggør eksekvering af vilkårlig kode.
Do you have this product installed on your home computer? Scan using the free Personal Software Inspector. Check if a vulnerable version is installed on computers in your corporate network, scan using the Network Software Inspector.
Løsning:
Installér patches.
Microsoft Excel 2000 (Office SP3):
http://www.microsoft.com/downloads/de...=5F101D03-C0A7-41E0-95A4-A12AFB356D5F
Microsoft Excel 2002 (Office SP3):
http://www.microsoft.com/downloads/de...=29596861-D9F0-4A10-9E1C-CDA75DDE017D
Microsoft Excel 2003 (Office SP2):
http://www.microsoft.com/downloads/de...=9567C583-556F-4379-80BA-3E0C8993C04C
Microsoft Excel 2003 Viewer:
http://www.microsoft.com/downloads/de...=3C7F18AC-24BB-41CF-B8DA-997706FDC44C
Microsoft Office Excel 2007:
http://www.microsoft.com/downloads/de...=CED9F11B-CE48-47A3-9288-BD11B80F3D85
Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats:
http://www.microsoft.com/downloads/de...=50A7924F-DB51-438A-B27D-37E40A471E60
Microsoft Office 2004 for Mac:
http://www.microsoft.com/mac
Rapporteret af / Kredit:
1) Fundet af Manuel Santamarina Suarez og rapporteret via ZDI.
2) Rapporteret af producenten.
3) Greg MacManus, iDefense Labs.
Forløb:
09-05-2007: Tilføjede yderligere information fra ZDI og iDefense Labs. Tilføjede link til US-CERT.
Original Advisory:
MS07-023 (934233):
http://www.microsoft.com/technet/security/Bulletin/MS07-023.mspx
ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-07-026.html
iDefense Labs:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=527
Andre Kilder:
US-CERT VU#253825:
http://www.kb.cert.org/vuls/id/253825
|
|
|
|
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
|
|
|
60 Relaterede Secunia Advisories, displaying 10
|
|
|
1. Microsoft Excel kode eksekvering
|
|
2. Microsoft Word uspecificeret hukommelses-korrumpering
|
|
3. Microsoft Windows OLE Automation hukommelses-korrumpering
|
|
4. Microsoft XML Core Services "substringData()" heltals-overflow
|
|
5. Microsoft Excel rtWnDesk record hukommelses-korrumpering
|
|
6. Microsoft Excel flere kode-eksekveringssårbarheder
|
|
7. Microsoft Office Publisher vilkårlig dereferering af pointere
|
|
8. Microsoft Visio eksekvering af vilkårlige kode
|
|
9. Microsoft Office drawing-objekt kode-eksekvering
|
|
10. Microsoft RichEdit OLE-dialog hukommelses-korrumpering
|
Vis alle relaterede advisories
|
|
|
Send Feedback to Secunia
|
|
Hvis du har ny information angående dette Secunia advisory eller et produkt i vores database, så send det venligst til os. Du kan sende det til os enten ved at bruge vores web formular eller ved at sende det til vuln@secunia.com.
Ideer, foreslag og andet feedback er også meget velkommen.
|
|
|
|
