> -----Original Message-----
> From:
> idlabs-advisories-bounces+vladimir.kazennov=billing.ru@idefens
> e.com
> [mailto:idlabs-advisories-bounces+vladimir.kazennov=billing.ru
> @idefense.com] On Behalf Of iDefense Labs Security Advisories
> Sent: Tuesday, January 09, 2007 10:21 PM
> To: iDefense Labs Security Advisories
> Subject: iDefense Security Advisory 01.09.07: Microsoft Excel
> Invalid ColumnHeap Corruption Vulnerability
>
> Microsoft Excel Invalid Column Heap Corruption Vulnerability
>
> iDefense Security Advisory 01.09.07
>
> Jan 09, 2007
>
> I. BACKGROUND
>
> Microsoft Excel is the spreadsheet application from the
> Microsoft Office
> System. More information is available at the following link:
>
>
>
> II. DESCRIPTION
>
> Remote exploitation of an input validation error in Microsoft
> Corp.'s Excel
> spreadsheet application may allow the execution of arbitrary code.
>
> The vulnerability specifically exists in the handling of out of range
> values in the column field in several BIFF8 record types. By
> supplying an
> invalid Column field to one of these records, it is possible
> to cause the
> system to reference arbitrary memory. This can be exploited to gain
> control of the application.
>
> III. ANALYSIS
>
> Successful exploitation of this vulnerability would allow an
> attacker to
> execute arbitrary code in the context of the user who opened
> the document.
> In order exploit this vulnerability, an attacker would need
> to convince the
> target to open an Excel spreadsheet file. Likely attack
> vectors include
> sending the file as an attachment in an email or linking to
> the file on a
> website.
>
> Systems with a default install of Office 2000 will open
> Office documents,
> including Excel spreadsheet files, from websites without prompting the
> user. This allows an attacker to exploit this vulnerability
> without user
> interaction beyond visiting a website. Later versions of
> Office will not
> open these documents automatically unless the user has chosen this
> behavior.
>
> IV. DETECTION
>
> iDefense has confirmed the existence of this vulnerability in
> Microsoft
> Excel 2003 with all available service packs and security
> patches. Previous
> versions of Excel are also likely to be affected.
>
> V. WORKAROUND
>
> Do not follow links or open files from unknown sources or
> that you were not
> expecting to receive.
>
> VI. VENDOR RESPONSE
>
> Microsoft has addressed this vulnerability with Microsoft
> Security Bulletin
> MS07-002. A link to this bulletin can be found below.
>
>
>
> VII. CVE INFORMATION
>
> The Common Vulnerabilities and Exposures (CVE) project has
> assigned the
> name CVE-2007-0030 to this issue. This is a candidate for inclusion in
> the CVE list (), which standardizes names for
> security problems.
>
> VIII. DISCLOSURE TIMELINE
>
> 09/14/2006 Initial vendor notification
> 09/15/2006 Initial vendor response
> 01/09/2007 Coordinated public disclosure
>
> IX. CREDIT
>
> This vulnerability was discovered by Greg MacManus, iDefense Labs.
>
> Get paid for vulnerability research
>
>
> Free tools, research and upcoming events
>
>
> X. LEGAL NOTICES
>
> Copyright (c) 2006 iDefense, Inc.
>
> Permission is granted for the redistribution of this alert
> electronically.
> It may not be edited in any way without the express written consent of
> iDefense. If you wish to reprint the whole or any part of
> this alert in
> any other medium other than electronically, please e-mail
> customerservice@xxxxxxxxxxxx for permission.
>
> Disclaimer: The information in the advisory is believed to be
> accurate at
> the time of publishing based on currently available
> information. Use of
> the information constitutes acceptance for use in an AS IS condition.
> There are no warranties with regard to this information. Neither the
> author nor the publisher accepts any liability for any
> direct, indirect,
> or consequential loss or damage arising from use of, or
> reliance on, this
> information.
>
> _______________________________________________
> To unsubscribe, go here:
>
>
