[36489] in bugtraq
Microsoft Office WordPerfect Converter Buffer Overflow Vulnerability
daemon@ATHENA.MIT.EDU (Jérôme" ATHIAS)
Tue Sep 14 19:17:23 2004
Date: 14 Sep 2004 18:56:40 -0000
Message-ID: <20040914185640.17477.qmail@www.securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: "Jérôme" ATHIAS <jerome.athias@caramail.com>
To: bugtraq@securityfocus.com
Microsoft Office WordPerfect Converter Buffer Overflow Vulnerability
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0573
Peter Winter-Smith has reported a vulnerability in various Microsoft Office products, which can be exploited by malicious people to compromise a user's system.
The vulnerability is caused due to a boundary error within the WordPerfect Converter and can be exploited to cause a buffer overflow if a user opens a malicious document.
Successful exploitation may allow execution of arbitrary code with the users privileges.
The vulnerability affects WordPerfect Converter 5.x, which is included in various Microsoft Office products.
Solution:
Microsoft has released updates.
Microsoft Office 2000 Software (SP 3):
http://www.microsoft.com/downloads/details.aspx?FamilyId=88F52E69-99E1-4892-9A53-84E5DFADFE6B
Microsoft Office XP Software (SP 3):
http://www.microsoft.com/downloads/details.aspx?FamilyId=10A6CEB3-7B94-4F74-A5A0-60C31CE2F57B
Microsoft Office 2003:
http://www.microsoft.com/downloads/details.aspx?FamilyId=A0629800-1889-495B-B25E-4637D6B03250
Microsoft Works Suite 2001:
http://www.microsoft.com/downloads/details.aspx?FamilyId=88F52E69-99E1-4892-9A53-84E5DFADFE6B
Microsoft Works Suite 2002:
http://www.microsoft.com/downloads/details.aspx?FamilyId=10A6CEB3-7B94-4F74-A5A0-60C31CE2F57B
Microsoft Works Suite 2003:
http://www.microsoft.com/downloads/details.aspx?FamilyId=10A6CEB3-7B94-4F74-A5A0-60C31CE2F57B
Microsoft Works Suite 2004:
http://www.microsoft.com/downloads/details.aspx?FamilyId=10A6CEB3-7B94-4F74-A5A0-60C31CE2F57B
Provided and/or discovered by:
Peter Winter-Smith, Next Generation Security Software.
Original Advisory:
MS04-027 (KB884933):
http://www.microsoft.com/technet/security/bulletin/ms04-027.mspx
Regards,
Jerome ATHIAs
