OSVDB ID: 27150

Title: Microsoft Office MSO.DLL String Processing Overflow

Info

Disclosure
Jul 11, 2006

Discovery
Unknown

Dates

Exploit
Feb 12, 2006

Solution
Jul 11, 2006

Description

 A local overflow exists in Office, Project, Visio and Office for Mac. MSO.DLL fails to validate Office documents resulting in a buffer overflow. With a specially crafted file containing a malformed string, an attacker can cause arbitrary code execution resulting in a loss of integrity.

Classification

 Location: Local Access Required
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Patch / RCS
Exploit: Exploit Public
Disclosure: OSVDB Verified, Vendor Verified

Solution

 Currently, there are no known workarounds or upgrades to correct this issue. However, Microsoft has released a patch to address this vulnerability.

Products

Microsoft Corporation

Office

 2003 SP1
2003 SP2
XP SP3
2000 SP3
2004 for Mac
v. X for Mac

Project

 2002 SP1
2000 Service Release 1

Visio

 2002 SP2

References

Credit
  • Elia Florio - elia_floriosymantec.com - Symantec Corp.


Direct URL: http://osvdb.org/27150