National Cyber-Alert System

Vulnerability Summary for CVE-2006-1540

Overview

MSO.DLL in Microsoft Office 2000, Office XP (2002), and Office 2003 allows user-assisted attackers to cause a denial of service and execute arbitrary code via multiple attack vectors, as originally demonstrated using a crafted document record with a malformed string, as demonstrated by replacing a certain "01 00 00 00" byte sequence with an "FF FF FF FF" byte sequence, possibly causing an invalid array index, in (1) an Excel .xls document, which triggers an access violation in ole32.dll; (2) an Excel .xlw document, which triggers an access violation in excel.exe; (3) a Word document, which triggers an access violation in mso.dll in winword.exe; and (4) a PowerPoint document, which triggers an access violation in powerpnt.txt. NOTE: after the initial disclosure, this issue was demonstrated by triggering an integer overflow using an inconsistent size for a Unicode "Sheet Name" string.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Technical Alert: TA06-192A

Name: TA06-192A

Hyperlink:http://www.us-cert.gov/cas/techalerts/TA06-192A.html

US-CERT Vulnerability Note: VU#609868

Name: VU#609868

Hyperlink:http://www.kb.cert.org/vuls/id/609868

External Source: XF

Name: office-property-string-bo(27609)

Hyperlink:http://xforce.iss.net/xforce/xfdb/27609

External Source: XF

Name: office-string-parse-bo(27607)

Hyperlink:http://xforce.iss.net/xforce/xfdb/27607

External Source: BID

Name: 18889

Hyperlink:http://www.securityfocus.com/bid/18889

External Source: BID

Name: 17252

Hyperlink:http://www.securityfocus.com/bid/17252

External Source: BUGTRAQ

Name: 20060710 SYMSA-2006-007: Microsoft Office Malformed String Parsing Vulnerability

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/439697/100/0/threaded

External Source: OSVDB

Name: 27150

Hyperlink:http://www.osvdb.org/27150

External Source: MILW0RM

Name: 1615

Hyperlink:http://www.milw0rm.com/exploits/1615

External Source: MS

Name: MS06-038

Hyperlink:http://www.microsoft.com/technet/security/bulletin/ms06-038.mspx

External Source: VUPEN

Name: ADV-2006-2756

Hyperlink:http://www.frsirt.com/english/advisories/2006/2756

External Source: SECTRACK

Name: 1015855

Hyperlink:http://securitytracker.com/id?1015855

External Source: SECUNIA

Name: 21012

Hyperlink:http://secunia.com/advisories/21012

US Government Resource: oval:org.mitre.oval:def:639

Name: oval:org.mitre.oval:def:639

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:639