bugtraq - Re: The newest Word flaw is due to malformed data structure handling

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:  Tue, 12 Dec 2006 14:31:20 -0000
From: "Dave \"No, not that one\" Korn" <davek_throwaway@...mail.com>
To: bugtraq@...urityfocus.com
Cc: full-disclosure@...ts.grok.org.uk
Subject:  Re: The newest Word flaw is due to malformed data structure handling

Juha-Matti Laurio wrote:
> Related to the newest MS Word 0-day
> http://blogs.technet.com/msrc/archive/2006/12/10/new-report-of-a-word-zero-day.aspx
>
> US-CERT Vulnerability Note VU#166700 released today lists the
> following new technical detail:
> "Microsoft Word fails to properly handle malformed data structures
> allowing memory corruption to occur."
> http://www.kb.cert.org/vuls/id/166700
> - Juha-Matti


  That's kind-of a truism, since word files basically /are/ serialised data 
structures.  Well, assuming we're not talking about some new xml format but 
native word .doc format.


    cheers,
      DaveK
-- 
Can't think of a witty .sigline today....