Microsoft Office 2000 UA OUACTRL.OCX ActiveX Control Buffer Overflow Vulnerability

TITLE: Microsoft Office 2000 UA OUACTRL.OCX ActiveX Control Buffer Overflow Vulnerability
CLASS: Boundary Condition Error
CVE:
REMOTE: Yes
LOCAL: No
PUBLISHED: May 23 2007 12:00AM
UPDATE: May 30 2007 05:11PM
CREDIT: Shinnai is credited with the discovery of this issue.
VULNERABLE:

Microsoft Office 2000 Multilanguage Packs 0
Microsoft Office 2000 Korean Version
Microsoft Office 2000 Japanese Version
Microsoft Office 2000 Chinese Version
Microsoft Office 2000 SP3
-Microsoft Windows 2000 Professional SP3
-Microsoft Windows 2000 Professional SP2
-Microsoft Windows 2000 Professional SP1
-Microsoft Windows 2000 Professional
-Microsoft Windows 98
-Microsoft Windows 98SE
-Microsoft Windows ME
-Microsoft Windows NT Workstation 4.0 SP6a
-Microsoft Windows NT Workstation 4.0 SP6
-Microsoft Windows NT Workstation 4.0 SP5
-Microsoft Windows NT Workstation 4.0 SP4
-Microsoft Windows NT Workstation 4.0 SP3
-Microsoft Windows NT Workstation 4.0 SP2
-Microsoft Windows NT Workstation 4.0 SP1
-Microsoft Windows NT Workstation 4.0
-Microsoft Windows XP Home SP1
-Microsoft Windows XP Home
-Microsoft Windows XP Professional SP1
-Microsoft Windows XP Professional
Microsoft Office 2000 SP1
-Microsoft Windows 2000 Professional SP2
-Microsoft Windows 2000 Professional SP1
-Microsoft Windows 2000 Professional
-Microsoft Windows ME
-Microsoft Windows NT Workstation 4.0 SP6a
-Microsoft Windows NT Workstation 4.0 SP6
-Microsoft Windows NT Workstation 4.0 SP5
-Microsoft Windows NT Workstation 4.0 SP4
-Microsoft Windows NT Workstation 4.0 SP3
-Microsoft Windows NT Workstation 4.0 SP2
-Microsoft Windows NT Workstation 4.0 SP1
-Microsoft Windows NT Workstation 4.0
-Microsoft Windows XP Home
-Microsoft Windows XP Professional
Microsoft Office 2000
-Microsoft Windows 2000 Professional SP2
-Microsoft Windows 2000 Professional SP1
-Microsoft Windows 2000 Professional
-Microsoft Windows 95
-Microsoft Windows 98
-Microsoft Windows ME
-Microsoft Windows NT Workstation 4.0 SP6a
-Microsoft Windows NT Workstation 4.0 SP6
-Microsoft Windows NT Workstation 4.0 SP5
-Microsoft Windows NT Workstation 4.0 SP4
-Microsoft Windows NT Workstation 4.0 SP3
-Microsoft Windows NT Workstation 4.0 SP2
-Microsoft Windows NT Workstation 4.0 SP1
-Microsoft Windows NT Workstation 4.0
-Microsoft Windows XP Home
-Microsoft Windows XP Professional
Microsoft Internet Explorer for Unix SP2
NOT VULNERABLE:

Vai alla pagina originale su Security Focus

Discussion

Microsoft Office 2000 UA ActiveX Control is prone to a buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts likely result in denial-of-service conditions.

Exploit

To exploit this issue, an attacker must entice an unsuspecting user to access a malicious webpage.

The following exploit code is available:

Solution

Solution:
This issue is addressed in version 2.0 of the affected ActiveX control. Users are advised to update to the latest version of Microsoft Office 2000 with all appropriate patches.


Microsoft Office 2000


Microsoft Office 2000 SP1

Microsoft Office 2000 SP3

Microsoft Internet Explorer for Unix SP2

References

References:

PhpLog

BNLug Benevento Linux Users Group