bugtraq - VUPEN Security - Microsoft Office Word Document Parsing Buffer Overflow Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Thu, 11 Jun 2009 23:14:48 +0200
From: "VUPEN Security Research" <advisories@...en.com>
To: <bugtraq@...urityfocus.com>
Subject: VUPEN Security - Microsoft Office Word Document Parsing Buffer Overflow Vulnerability

VUPEN Security Research Advisory - VUPEN-SR-2008-06

Advisory URL: http://www.vupen.com/english/advisories/2009/1546

June 9, 2009

I. BACKGROUND 
-----------------------

Microsoft Office Word, included in the Microsoft Office system,
is a powerful authoring program that gives you the ability to
create and share documents by combining a comprehensive set of
writing tools with the easy-to-use Microsoft Office Fluent user
interface.

II. DESCRIPTION 
----------------------

VUPEN Security discovered a critical vulnerability affecting Microsoft
Office Word.

This vulnerability is caused by a buffer overflow error within the
parsing of certain data within a Word file, which could allow attackers
to execute arbitrary code by tricking a user into opening a specially
crafted document.

III. AFFECTED PRODUCTS
--------------------------------

According to the vendor, the following products are affected:

- Microsoft Office Word 2007 Service Pack 2
- Microsoft Office Word 2007 Service Pack 1
- Microsoft Office Word 2002 Service Pack 3
- Microsoft Office for Mac 2004
- Microsoft Office for Mac 2008
- Open XML File Format Converter for Mac
- Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint
2007 File Formats Service Pack 1 and Microsoft Office Compatibility
Pack for Word, Excel, and PowerPoint 2007 File Formats Service Pack 2

IV. Exploit Codes & PoC
---------------------------

Fully functional remote code execution exploit codes have been developed
by VUPEN Security and are available with the in-depth binary analysis of
the vulnerability through the VUPEN Exploits & PoCs Service.

http://www.vupen.com/exploits

V. SOLUTION 
-----------------

Apply patch MS09-027 :
http://www.microsoft.com/technet/security/bulletin/ms09-027.mspx

VI. CREDIT 
--------------

Thse vulnerability was discovered by Nicolas JOLY of VUPEN Security

VII. REFERENCES
-----------------

http://www.vupen.com/english/advisories/2009/1546
http://www.microsoft.com/technet/security/bulletin/ms09-027.mspx
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0565

VIII. DISCLOSURE TIMELINE 
--------------------------

28/11/2008 - Vendor notified
28/11/2008 - Vendor response
20/01/2009 - Status update received
09/06/2009 - Coordinated public Disclosure