MS03-037: Flaw in VBA Arbitrary Code Execution

[Steven]

-----BEGIN PGP SIGNED MESSAGE-----

- ----------------------------------------------------------------------

Title: Flaw in Visual Basic for Applications Could Allow

Arbitrary Code Execution (822715)

Date: 03 September 2003

Affected Software:

Microsoft Visual Basic for Applications SDK 5.0

Microsoft Visual Basic for Applications SDK 6.0

Microsoft Visual Basic for Applications SDK 6.2

Microsoft Visual Basic for Applications SDK 6.3

Products which include the affected software:

Microsoft Access 97

Microsoft Access 2000

Microsoft Access 2002

Microsoft Excel 97

Microsoft Excel 2000

Microsoft Excel 2002

Microsoft PowerPoint 97

Microsoft PowerPoint 2000

Microsoft PowerPoint 2002

Microsoft Project 2000

Microsoft Project 2002

Microsoft Publisher 2002

Microsoft Visio 2000

Microsoft Visio 2002

Microsoft Word 97

Microsoft Word 98(J)

Microsoft Word 2000

Microsoft Word 2002

Microsoft Works Suite 2001

Microsoft Works Suite 2002

Microsoft Works Suite 2003

Microsoft Business Solutions Great Plains 7.5

Microsoft Business Solutions Dynamics 6.0

Microsoft Business Solutions Dynamics 7.0

Microsoft Business Solutions eEnterprise 6.0

Microsoft Business Solutions eEnterprise 7.0

Microsoft Business Solutions Solomon 4.5

Microsoft Business Solutions Solomon 5.0

Microsoft Business Solutions Solomon 5.5

Impact: Run code of attackers choice

Max Risk: Critical

Bulletin: MS03-037

Microsoft encourages customers to review the Security Bulletins

at:

http://www.microsoft.com/technet/security/...in/MS03-037.asp

http://www.microsoft.com/security/security...ns/ms03-037.asp

- ----------------------------------------------------------------------

Issue:

======

Microsoft VBA is a development technology for developing client

desktop packaged applications and integrating them with existing

data and systems. Microsoft VBA is based on the Microsoft Visual

Basic development system. Microsoft Office products include VBA

and make use of VBA to perform certain functions. VBA can also be

used to build customized applications based around an existing

host application.

A flaw exists in the way VBA checks document properties passed to

it when a document is opened by the host application. A buffer

overrun exists which if exploited successfully could allow an

attacker to execute code of their choice in the context of the

logged on user.

In order for an attack to be successful, a user would have to

open a specially crafted document sent to them by an attacker.

This document could be any type of document that supports VBA,

such as a Word document, Excel spreadsheet, PowerPoint

presentation. In the case where Microsoft Word is being used as

the HTML e-mail editor for Microsoft Outlook, this document could

be an e-mail, however the user would need to reply to, or forward

the mail message in order for the vulnerability to be exploited.

Mitigating Factors:

====================

- -The user must open a document sent to them by an attacker in

order for this vulnerability to be exploited.

- -When Microsoft Word is being used as the HTML e-mail editor in

Outlook, a user would need to reply to or forward a malicious e-

mail document sent to them in order for this vulnerability to be

exploited.

- -An attacker's code could only run with the same rights as the

logged on user. The specific privileges the attacker could gain

through this vulnerability would therefore depend on the

privileges granted to the user. Any limitations on a user's

account, such as those applied through Group Policies, would also

limit the actions of any arbitrary code executed by this

vulnerability.

Risk Rating:

============

- Critical

Patch Availability:

===================

- A patch is available to fix this vulnerability. Please read

the Security Bulletins at

http://www.microsoft.com/technet/security/...in/ms03-037.asp

http://www.microsoft.com/security/security...ns/ms03-037.asp

for information on obtaining this patch.

Acknowledgment:

===============

- eEye Digital Security, http://www.eeye.com

Edited September 3, 2003 by xStainDx