OSVDB ID: 23901

Title: Microsoft Office Excel Malformed Graphic Arbitrary Code Execution

Info

Disclosure
Mar 14, 2006

Discovery
Unknown

Dates

Exploit
Unknown

Solution
Unknown

Description

 A user-complicit overflow exists in Excel. The product fails to correctly interpret an undisclosed graphic file format resulting in a buffer overflow. With a specially crafted request, an attacker can cause arbitrary code execution resulting in a loss of integrity.

Classification

 Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Unknown
Disclosure: OSVDB Verified

Solution

 Currently, there are no known workarounds or upgrades to correct this issue. However, the vendor has released a patch to address this vulnerability.

Products

Microsoft Corporation

Word

 2000
2002
2003

Works Suite

 2000
2001
2002
2004
2003
2005
2006

Excel

 2000
2002
2003
2004 for Mac
v. X for Mac

Outlook

 2000
2003

PowerPoint

 2002
2003
2000

Office

 2003 SP1
2004 for Mac
2000 SP3
v. X for Mac
XP Multilingual User Interface Packs
2000 Multilanguage Packs
2003 SP2
XP SP3

Excel Viewer

 2000
2002
2003

References

Credit

Unknown or Incomplete


Direct URL: http://osvdb.org/23901