OSVDB ID: 23902

Title: Microsoft Office Excel Malformed Record Arbitrary Code Execution

Info

Disclosure
Mar 14, 2006

Discovery
Unknown

Dates

Exploit
Unknown

Solution
Unknown

Description

 A remote overflow exists in Excel. The product fails to check the length of a buffer of a record resulting in a stack overflow. With a specially crafted .xls file, an attacker can cause arbitrary code execution resulting in a loss of integrity.

Classification

 Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Unknown
Disclosure: OSVDB Verified

Solution

 Currently, there are no known workarounds or upgrades to correct this issue. However, the vendor has released a patch to address this vulnerability.

Products

Microsoft Corporation

Word

 2000
2002
2003

Works Suite

 2000
2001
2002
2004
2003
2005
2006

Excel

 2000
2002
2003
2004 for Mac
v. X for Mac

Outlook

 2000
2003

PowerPoint

 2002
2000
2003

Office

 2003 SP1
2004 for Mac
2000 SP3
v. X for Mac
XP Multilingual User Interface Packs
2000 Multilanguage Packs
XP SP3

Excel Viewer

 2000
2002
2003

References

Credit
  • Eyas - securityxfocus.org - XFOCUS Security Team


Direct URL: http://osvdb.org/36218