TippingPoint Zero Day Initiative
 

Microsoft Word Malformed Chart Code Execution Vulnerability

ZDI-06-034: October 10th, 2006

CVE ID

Affected Vendors

Affected Products

TippingPoint™ IPS Customer Protection

TippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID 4772. For further product information on the TippingPoint IPS:

Vulnerability Details

This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Microsoft Office. Exploitation requires that the attacker coerce the target user into opening a malicious .XLS file.

The specific flaw exists during the processing of malformed charts embedded within a Word document. Upon closing the document, certain pointers are corrupted with data direclty from the file. A later dereference of these corrupted pointers can result in code execution.

Vendor Response

Microsoft has issued an update to correct this vulnerability. More details can be found at:

Disclosure Timeline

    2006-06-14 - Vulnerability reported to vendor
    2006-10-10 - Coordinated public release of advisory

Credit

This vulnerability was discovered by:
    Arnaud Dovi 'class101' http://heapoverflow.com