A vulnerability has been identified in Microsoft Visual Basic for Applications (VBA) allowing malicious Office or HTML documents to cause a buffer overflow.

The problem is that VBA (VBE.DLL and VBE6.DLL) doesn't check the "ID" parameter properly before processing the document. This allows malicious people to create a document, which could cause a buffer overflow and execute arbitrary code.

This affects all programs, which use VBA to process documents. This includes Internet Explorer if Microsoft Office programs are installed because Office documents are automatically opened with a helper application.

Solution
Apply patches:
Further details available in Customer Area

Provided and/or discovered by
Yuji "The Ninja" Ukai
eEye Digital Security

Changelog
Further details available in Customer Area

Original Advisory
http://www.microsoft.com/technet/security/bulletin/MS03-037.asp
http://www.eeye.com/html/Research/Advisories/AD20030903-2.html

Deep Links
Links available in Customer Area