English

Calendar Discussions Polls

RSS feeds Subscriptions Contacts

The Internet threat alert status is currently normal. At present, no major epidemics or other serious incidents have been recorded by Kaspersky Lab’s monitoring service.

Internet threat level: 1

Read us on

Home→Descriptions→SA21735

Microsoft Word Code Execution Vulnerabilities

Secunia ID	SA21735
CVE-ID	CVE-2006-4534, CVE-2006-3647, CVE-2006-3651, CVE-2006-4693
Release Date	05 Sep 2006
Last Change	13 Oct 2006
Criticality	Extremely Critical
Solution Status	Vendor Patch
Software	Microsoft Office 2000 Microsoft Office 2003 Professional Edition Microsoft Office 2003 Small Business Edition Microsoft Office 2003 Standard Edition Microsoft Office 2003 Student and Teacher Edition Microsoft Office 2004 for Mac Microsoft Office Word Viewer 2003 Microsoft Office X for Mac Microsoft Office XP Microsoft Word 2000 Microsoft Word 2002 Microsoft Word 2003 Microsoft Works Suite 2004 Microsoft Works Suite 2005 Microsoft Works Suite 2006
Where	From remote
Impact	System access This covers vulnerabilities where malicious people are able to gain system access and execute arbitrary code with the privileges of a local user.
Description	Multiple vulnerabilities have been reported in Microsoft Word, which can be exploited by malicious people to compromise a user's system. 1) An unspecified boundary error in WINWORD.EXE when processing Word documents can be exploited to cause a buffer overflow via a specially crafted document. NOTE: The vulnerability is being actively exploited. 2) An unspecified boundary error within the parsing of certain strings can be exploited to cause a buffer overflow via a specially crafted document. 3) An unspecified boundary error within the handling of mail merge files can be exploited to cause a buffer overflow via a specially crafted document. 4) An unspecified error within the parsing of certain strings can be exploited to execute arbitrary code via a specially crafted document. Successful exploitation of the vulnerabilities allows execution of arbitary code.
Solution	Apply patches. Microsoft Office 2000 SP3 / Microsoft Word 2000: http://www.microsoft.com/downloads/details.aspx?FamilyId=CFC85449-4941-4DA5-A919-1DA388054E83 Microsoft Office XP SP3 / Microsoft Word 2002: http://www.microsoft.com/downloads/details.aspx?FamilyId=5652303E-04B3-4713-AF2E-2C8D2450468D Microsoft Office 2003 (SP1 or SP2) / Microsoft Office Word 2003 http://www.microsoft.com/downloads/details.aspx?FamilyId=30C516EB-BD63-4248-A34D-47AF7E9EA55A Microsoft Office Word 2003 Viewer: http://www.microsoft.com/downloads/details.aspx?FamilyId=EB230319-14A5-4206-A601-CF9DDE89352A Microsoft Works Suites (2004/2005/2006): http://www.microsoft.com/downloads/details.aspx?FamilyId=5652303E-04B3-4713-AF2E-2C8D2450468D Microsoft Office 2004 for Mac: Download the update (KB924999) http://www.microsoft.com/mac/ Microsoft Office v. X for Mac: Download the update (KB924998) http://www.microsoft.com/mac/
Reported by	1) Discovered in the wild as a 0-day 2) The vendor credits Chen Xiaobo of McAfee Avert Labs 3) The vendor credits Cu Fang 4) The vendor credits Cu Fang
Original Advisory	MS06-060 (KB924554): http://www.microsoft.com/technet/security/Bulletin/MS06-060.mspx Microsoft: http://www.microsoft.com/technet/security/advisory/925059.mspx