bugtraq - About the latest three Powerpoint vulnerabilities: exploitable?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060718130208.28355.qmail@securityfocus.com>
Date: 18 Jul 2006 13:02:08 -0000
From: ewt@...ecomitalia.it
To: bugtraq@...urityfocus.com
Subject: About the latest three Powerpoint vulnerabilities: exploitable?

We have analyzed the three proof-of-concept documents recently posted on the mailing list, and they don't appear exploitable to us. Specifically:
 - powerpnt.exe: NULL pointer dereference, unusable. Are we missing anything?
 - memory corruption: we apparently control the address, but not the contents written to it. Doesn't appear usable
 - mso.dll: this didn't work for us. We see an integer overflow exception being raised with RaiseException, followed by a C++ exception, but no apparent side effects. PowerPoint complains, but closes cleanly and works fine thereafter

Is any of the three supposed to go beyond a local DoS? anyone else has analyzed them?