A vulnerability has been reported in Microsoft Office OneNote, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to missing input validation when processing a URI using the "onenote://" protocol handler. This can be exploited to e.g. place files on a user's system in semi-arbitrary locations or obtain all OneNote Notebooks from the user's system via a specially crafted OneNote URI.

NOTE: According to the vendor, the vulnerability exists in a shared Office component, but can only be exploited on systems with OneNote 2007 installed.

Solution
Apply patches.
Further details available in Customer Area

Provided and/or discovered by
Brett Moore, Insomnia Security.

Changelog
Further details available in Customer Area

Original Advisory
MS08-055 (KB955047):
http://www.microsoft.com/technet/security/Bulletin/MS08-055.mspx

Insomnia Security:
http://www.insomniasec.com/advisories/ISVA-080910.1.htm

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available in Customer Area