MS03-035: Flaw In Microsoft Word...

[Steven]

-----BEGIN PGP SIGNED MESSAGE-----

- -------------------------------------------------------------------

Title: Flaw in Microsoft Word Could Enable Macros to Run

Automatically (827653)

Date: September 3, 2003

Software: Microsoft Word 97

Microsoft Word 98 (J)

Microsoft Word 2000

Microsoft Word 2002

Microsoft Works Suite 2001

Microsoft Works Suite 2002

Microsoft Works Suite 2003

Impact: Run macros without warning

Max Risk: Important

Bulletin: MS03-035

Microsoft encourages customers to review the Security Bulletins at:

http://www.microsoft.com/technet/security/...in/MS03-035.asp

http://www.microsoft.com/security/security...ns/MS03-035.asp

- -------------------------------------------------------------------

Issue:

======

A macro is a series of commands and instructions that can be

grouped together as a single command to accomplish a task

automatically. Microsoft Word supports the use of macros to allow

the automation of commonly performed tasks. Since macros are

executable code it is possible to misuse them, so Microsoft Word

has a security model designed to validate whether a macro should be

allowed to execute depending on the level of macro security the

user has chosen.

A vulnerability exists because it is possible for an attacker to

craft a malicious document that will bypass the macro security

model. If the document was opened, this flaw could allow a

malicious macro embedded in the document to be executed

automatically, regardless of the level at which macro security is

set. The malicious macro could take the same actions that the user

had permissions to carry out, such as adding, changing or deleting

data or files, communicating with a web site or formatting the hard

drive.

The vulnerability could only be exploited by an attacker who

persuaded a user to open a malicious document - there is no way for

an attacker to force a malicious document to be opened.

Mitigating Factors:

====================

- The user must open the malicious document for an attacker to be

successful. An attacker cannot force the document to be opened

automatically.

- The vulnerability cannot be exploited automatically through e-

mail. A user must open an attachment sent in e-mail for an e-

mail borne attack to be successful.

- By default, Outlook 2002 block programmatic access to the

Address Book. In addition, Outlook 98 and 2000 block

programmatic access to the Outlook Address Book if the Outlook

Email Security Update has been installed. Customers who use any

of these products would not be at risk of propagating an e-mail

borne attack that attempted to exploit this vulnerability.

- The vulnerability only affects Microsoft Word - other members of

the Office product family are not affected.

Risk Rating:

============

-Important

Patch Availability:

===================

- A patch is available to fix this vulnerability. Please read the

Security Bulletins at

http://www.microsoft.com/technet/security/...in/MS03-035.asp

http://www.microsoft.com/security/security...ns/MS03-035.asp

for information on obtaining this patch.

Acknowledgment:

===============

- Jim Bassett of Practitioners Publishing Company

(http://www.ppcnet.com)

- -------------------------------------------------------------------

Edited September 4, 2003 by xStainDx