MS03-050: Vulnerability in Microsoft Word, Excel

[Steven]

Vulnerability in Microsoft Word and Microsoft Excel Could Allow Arbitrary Code to Run (831527)

Issued: November 11, 2003

Version: 1.0

See all Office bulletins released November, 2003

Summary

Who should read this document: Customers who are using Microsoft? Excel or Microsoft Word

Impact of vulnerability: Run code of attackers choice

Maximum Severity Rating: Important

Recommendation: Customers who are using the affected versions of Microsoft Excel or Microsoft Word should apply the appropriate security update at the earliest opportunity.

Security Update Replacement Excel: This patch replaces the security patches contained in the following bulletins: MS01-050, MS02-031 and MS02-059.

Security Update Replacement Word: This patch replaces the security patches contained in the following bulletins: MS02-021, MS02-031, MS02-059 and MS03-035.

Caveats: None

Tested Software and Security Update Download Locations:

Affected Software:

Microsoft Excel 97 - Download the update

Microsoft Excel 2000 - Download the update

Microsoft Excel 2002 - Download the update

Microsoft Word 97 - Download the update

Microsoft Word 98(J) - Download the update

Microsoft Word 2000 and Microsoft Works Suite 2001 - Download the update

Microsoft Word 2002, Microsoft Works Suite 2002, Microsoft Works Suite 2003, and Microsoft Works Suite 2004 - Download the update

Non Affected Software:

Microsoft Office Word 2003

Microsoft Office Excel 2003

Technical description:

A security vulnerability exists in Microsoft Excel that could allow malicious code execution. This vulnerability exists because of the method Excel uses to check the spreadsheet before reading the macro instructions. If successfully exploited, an attacker could craft a malicious file that could bypass the macro security model. If an affected spreadsheet was opened, this vulnerability could allow a malicious macro embedded in the file to be executed automatically, regardless of the level at which the macro security is set. The malicious macro could then take the same actions that the user had permissions to carry out, such as adding, changing or deleting data or files, communicating with a web site or formatting the hard drive.

A security vulnerability exists in Microsoft Word that could allow malicious code execution. This vulnerability exists due to to the way Word checks the length of a data value (Macro names) embedded in a document. If a specially crafted document were to be opened it could overflow a data value in Word and allow arbitrary code to be executed. If successfully exploited, an attacker could then take the same actions as the user had permissions to carry out, such as adding, changing or deleting data or files, communicating with a web site or formatting the hard drive.

http://www.microsoft.com/technet/treeview/...in/MS03-050.asp