National Cyber-Alert System

Vulnerability Summary for CVE-2005-4131

Overview

Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via an Excel file with a malformed range, which could lead to memory corruption involving an argument to the msvcrt.memmove function, aka "Brand new Microsoft Excel Vulnerability," as originally placed for sale on eBay as item number 7203336538.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Technical Alert: TA06-073A

Name: TA06-073A

Hyperlink:http://www.us-cert.gov/cas/techalerts/TA06-073A.html

US-CERT Vulnerability Note: VU#642428

Name: VU#642428

Hyperlink:http://www.kb.cert.org/vuls/id/642428

External Source: BID

Name: 15780

Type: Patch Information

Hyperlink:http://www.securityfocus.com/bid/15780

External Source: XF

Name: excel-msvcrt-memmove-bo(23537)

Hyperlink:http://xforce.iss.net/xforce/xfdb/23537

External Source: MISC

Name: http://www.theregister.co.uk/2005/12/10/ebay_pulls_excel_vulnerability_auction/

Hyperlink:http://www.theregister.co.uk/2005/12/10/ebay_pulls_excel_vulnerability_auction/

External Source: MISC

Name: http://www.theage.com.au/news/breaking/excel-flaw-up-for-sale-on-ebay/2005/12/09/1134086783318.html

Hyperlink:http://www.theage.com.au/news/breaking/excel-flaw-up-for-sale-on-ebay/2005/12/09/1134086783318.html

External Source: MISC

Name: http://www.securityfocus.com/news/11363

Hyperlink:http://www.securityfocus.com/news/11363

External Source: BUGTRAQ

Name: 20060315 [HV-HIGH] Microsoft Excel Named Range Arbitrary Code Execution

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/427698/100/0/threaded

External Source: BUGTRAQ

Name: 20060314 High Risk Vulnerability in Microsoft Excel

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/427635/100/0/threaded

External Source: MISC

Name: http://www.osvdb.org/blog/?p=71

Hyperlink:http://www.osvdb.org/blog/?p=71

External Source: MS

Name: MS06-012

Hyperlink:http://www.microsoft.com/technet/security/bulletin/ms06-012.mspx

External Source: VUPEN

Name: ADV-2006-0950

Hyperlink:http://www.frsirt.com/english/advisories/2006/0950

External Source: MISC

Name: http://www.eweek.com/article2/0,1759,1899697,00.asp?kc=EWRSS03129TX1K0000614

Hyperlink:http://www.eweek.com/article2/0,1759,1899697,00.asp?kc=EWRSS03129TX1K0000614

External Source: MISC

Name: http://www.dicks-blog.com/archives/2005/12/08/excel-vulnerability-for-sale/

Hyperlink:http://www.dicks-blog.com/archives/2005/12/08/excel-vulnerability-for-sale/

External Source: CONFIRM

Name: http://support.avaya.com/elmodocs2/security/ASA-2006-069.htm

Hyperlink:http://support.avaya.com/elmodocs2/security/ASA-2006-069.htm

External Source: SECTRACK

Name: 1015766

Hyperlink:http://securitytracker.com/id?1015766

External Source: SECTRACK

Name: 1015333

Hyperlink:http://securitytracker.com/id?1015333

External Source: SECUNIA

Name: 19238

Type: Advisory

Hyperlink:http://secunia.com/advisories/19238

External Source: SECUNIA

Name: 19138

Type: Advisory

Hyperlink:http://secunia.com/advisories/19138

External Source: MISC

Name: http://news.zdnet.com/2100-1009_22-5989078.html

Hyperlink:http://news.zdnet.com/2100-1009_22-5989078.html

External Source: MISC

Name: http://news.com.com/2061-10789_3-5988086.html

Hyperlink:http://news.com.com/2061-10789_3-5988086.html

External Source: MISC

Name: http://news.com.com/2061-10789_3-5988086.html

Hyperlink:http://news.com.com/2061-10789_3-5988086.html

External Source: MISC

Name: http://informationweek.com/story/showArticle.jhtml?articleID=174910198

Hyperlink:http://informationweek.com/story/showArticle.jhtml?articleID=174910198

External Source: MISC

Name: http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&item=7203336538

Hyperlink:http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&item=7203336538

External Source: MISC

Name: http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&item=7203336538

Hyperlink:http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&item=7203336538

External Source: SREASON

Name: 591

Hyperlink:http://securityreason.com/securityalert/591

External Source: SREASON

Name: 584

Hyperlink:http://securityreason.com/securityalert/584