[security-alerts] FW: ZDI-07-026: Microsoft Excel BIFF File Format Named Graph Record Parsing Stack Overflow Vulnerability

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

Еще техническая информация об уязвимостях, устраняемых майскими патчами


> -----Original Message-----
> From: full-disclosure-bounces@xxxxxxxxxxxxxxxxx 
> [mailto:full-disclosure-bounces@xxxxxxxxxxxxxxxxx] On Behalf 
> Of zdi-disclosures@xxxxxxxx
> Sent: Tuesday, May 08, 2007 10:46 PM
> To: full-disclosure@xxxxxxxxxxxxxxxxx; bugtraq@xxxxxxxxxxxxxxxxx
> Subject: [Full-disclosure] ZDI-07-026: Microsoft Excel BIFF 
> File Format Named Graph Record Parsing Stack Overflow Vulnerability
> 
> ZDI-07-026: Microsoft Excel BIFF File Format Named Graph 
> Record Parsing
>             Stack Overflow Vulnerability
> http://www.zerodayinitiative.com/advisories/ZDI-07-026.html
> May  8, 2007
> 
> -- CVE ID:
> CVE-2007-0215
> 
> -- Affected Vendor:
> Microsoft
> 
> -- Affected Products:
> Office Excel 2000
> Office Excel 2002
> Office Excel 2003
> 
> -- TippingPoint(TM) IPS Customer Protection:
> TippingPoint IPS customers have been protected against this
> vulnerability since May  8, 2007 by Digital Vaccine protection
> filter ID 5330. For further product information on the 
> TippingPoint IPS:
> 
>     http://www.tippingpoint.com 
> 
> -- Vulnerability Details:
> This vulnerability allows remote attackers to execute 
> arbitrary code on
> vulnerable installations of Microsoft Office Excel. Exploitation
> requires that the attacker coerce the target into opening a malicious
> .XLS file.
> 
> The specific flaw exists within the parsing of the BIFF file format
> used by Microsoft Excel. During the processing of a malformed Named
> Graph record, user-supplied data may be copied to the stack unchecked
> thereby leading to an exploitable stack-based buffer overflow.
> 
> -- Vendor Response:
> Microsoft has issued an update to correct this vulnerability. More
> details can be found at:
> 
>     http://www.microsoft.com/technet/security/bulletin/ms07-023.mspx
> 
> -- Disclosure Timeline:
> 2006.11.16 - Vulnerability reported to vendor
> 2007.05.08 - Digital Vaccine released to TippingPoint customers
> 2007.05.08 - Coordinated public release of advisory
> 
> -- Credit:
> This vulnerability was discovered by Manuel Santamarina Suarez.
> 
> -- About the Zero Day Initiative (ZDI):
> Established by TippingPoint, a division of 3Com, The Zero Day 
> Initiative
> (ZDI) represents a best-of-breed model for rewarding security
> researchers for responsibly disclosing discovered vulnerabilities.
> 
> Researchers interested in getting paid for their security research
> through the ZDI can find more information and sign-up at:
> 
>     http://www.zerodayinitiative.com
> 
> The ZDI is unique in how the acquired vulnerability 
> information is used.
> 3Com does not re-sell the vulnerability details or any exploit code.
> Instead, upon notifying the affected product vendor, 3Com provides its
> customers with zero day protection through its intrusion prevention
> technology. Explicit details regarding the specifics of the
> vulnerability are not exposed to any parties until an official vendor
> patch is publicly available. Furthermore, with the altruistic aim of
> helping to secure a broader user base, 3Com provides this 
> vulnerability
> information confidentially to security vendors (including competitors)
> who have a vulnerability protection or mitigation product.
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>