45032 : Microsoft Word Document Malformed CSS Handling Memory Corruption Arbitrary Code Execution
Printer | http://osvdb.org/45032 | Email This | Edit Vulnerability

Views This Week Views All Time Added to OSVDB Last Modified Modified (since 2008) Percent Complete
3 1344 almost 6 years ago about 3 years ago 12 times 45%

This Entry needs help! It is only 45% Complete. Click the edit link above to add more information.

Contributing is fast and easy, and benefits the entire security community.

Timeline

Disclosure Date
2008-05-13

Description

<em style='font-weight:bold;'>(Description Provided by <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2008-1434" target="_blank">CVE</a>)</em> : Use-after-free vulnerability in Microsoft Word in Office 2000 and XP SP3, 2003 SP2 and SP3, and 2007 Office System SP1 and earlier allows remote attackers to execute arbitrary code via an HTML document with a large number of Cascading Style Sheets (CSS) selectors, related to a &quot;memory handling error&quot; that triggers memory corruption.

Classification

Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Private

Solution

Microsoft has released a patch to address this vulnerability. Additionally, it is possible to temporarily work around the flaw by implementing the following workaround: Users of Office 2003 and Office 2007 that have installed all security patches as of May 2007 can use the Microsoft Office File Block policy to prevent opening files of this type. To deploy this workaround, save and import the following registry file for the corresponding version of Office.

Office 2003:
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Word\Security\FileOpenBlock]
"HTMLFiles"=dword:00000001

Office 2007:
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\12.0\Word\Security\FileOpenBlock]

"HTMLFiles"=dword:00000001

Products

Unknown or Incomplete

References

Tools & Filters

32310 50057

Credit

CVSSv2 Score

CVSSv2 Base Score = 9.3
Source: nvd.nist.gov | Generated: 2008-05-13 | Disagree?

Access_vector_2 Access_complexity_1 Authentication_2 Confidentiality_impact_2 Integrity_impact_2 Availability_impact_2

Comments

No Comments.

The database information may change without any notice. Use of the information constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the copyright holder or distributor (OSVDB or OSF) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

© Copyright 2002 - 2014 Open Sourced Vulnerability Database (OSVDB), All Rights Reserved.
License - Privacy Statement - Terms of Use