Microsoft FrontPage Buffer Overflow in WordPerfect Converter Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1011250
|
|
SecurityTracker URL: http://securitytracker.com/id?1011250
|
|
CVE Reference: CAN-2004-0573
(Links to External Site)
|
Date: Sep 14 2004
|
Impact: Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): 2000, 2002, 2003
|
Description: A vulnerability was reported in Microsoft FrontPage in the WordPerfect converter. A remote user can execute arbitrary code on the target system. Microsoft Office, Microsoft Publisher, and Microsoft Works Suite are also affected.
Microsoft reported that a remote user can create a specially crafted document that, when loaded by the target user, will invoke the
WorkPerfect 5.x converter and then execute arbitrary code. The code will run with the privileges of the target user.
Microsoft
credits Peter Winter-Smith of Next Generation Security Software Ltd. with reporting this flaw.
The original advisory is available
at:
http://www.microsoft.com/technet/security/bulletin/ms04-027.mspx
|
Impact: A remote user can execute arbitrary code on the target system with the privileges of the target user.
|
Solution: The vendor has issued the following fixes.
This fix supercedes the update provided in Microsoft Security Bulletin MS03-036.
Microsoft
Office 2000 Software Service Pack 3 (Word 2000, FrontPage 2000, and Publisher 2000):
http://www.microsoft.com/downloads/details.aspx?FamilyId=88F52E69-99E1-4892-9A53-8
4E5DFADFE6B
Microsoft Office XP Software Service Pack 3 (Word 2002, FrontPage 2002, Publisher 2002):
http://www.microsoft.com/downloads/details.aspx?FamilyId=10A6CE
B3-7B94-4F74-A5A0-60C31CE2F57B
Microsoft Office 2003 (Word 2003, FrontPage 2003, Publisher 2003):
http://www.microsoft.com/downloads/details.aspx?FamilyId=A0629800-
1889-495B-B25E-4637D6B03250
Microsoft Works Suite 2001 - Download the update (same as Microsoft Office 2000 link):
http://www.microsoft.com/downloads/details.aspx?F
amilyId=88F52E69-99E1-4892-9A53-84E5DFADFE6B
Microsoft Works Suite 2002 - Download the update (same as the Microsoft Office XP
link):
http://www.microsoft.com/downloads/details.aspx?FamilyId=10A6CEB3-7B94-4F74-A5A0-60C31CE2F57B
Microsoft Works Suite
2003 - Download the update (same as the Microsoft Office XP link):
http://www.microsoft.com/downloads/details.aspx?FamilyId=10A6CEB3-7B94-4F74-A5A0-60C31CE2F57B
Mic
rosoft Works Suite 2004 - Download the update (same as the Microsoft Office XP link):
http://www.microsoft.com/downloads/details.aspx?FamilyId=10A6CEB3-7B94-4F74-A5A0-
60C31CE2F57B
Microsoft reports that an administrative update is also available for Office 2000 Software (applicable to Service
Pack 2 and Service Pack 3) and Office XP Software (applicable to Service Pack 2 and Service Pack 3). See the advisory for additional
information.
|
Vendor URL: www.microsoft.com/technet/security/bulletin/ms04-027.mspx (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 14 Sep 2004 12:59:35 -0400
Subject: http://www.microsoft.com/technet/security/bulletin/ms04-027.mspx
|
http://www.microsoft.com/technet/security/bulletin/ms04-027.mspx
|
|
