[16218] in bugtraq
Re: MS Word and MS Access vulnerability - executing arbitrary
daemon@ATHENA.MIT.EDU (David LeBlanc)
Mon Aug 14 12:49:46 2000
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Message-ID: <3.0.5.32.20000812100658.034c5a80@pop.mindspring.com>
Date: Sat, 12 Aug 2000 10:06:58 -0700
Reply-To: David LeBlanc <dleblanc@mindspring.com>
From: David LeBlanc <dleblanc@mindspring.com>
X-To: Ben Greenbaum <bgreenbaum@SECURITYFOCUS.COM>
To: BUGTRAQ@SECURITYFOCUS.COM
In-Reply-To: <Pine.GSO.4.21.0008101701160.22628-100000@mail>
At 05:04 PM 8/10/00 -0700, Ben Greenbaum wrote:
>"This may be exploited also by visiting a web page with IE or
>opening/previewing HTML email message with Outlook."
>While this sentence is accurate, it is misleading as this vulnerability
>can be exploited via any delivery mechanism at all, including Netscape
>Navigator, Netscape Messenger, ftp etc. As long as the file is delivered
>and opened in a vulnerable version of Word/Access, it works.
It is also a good thing to note that either the Word file and the Access
database both have to be delivered at once, or the victim has to be able to
open the Access file in some manner. For example, posting an Access file to
some SMB share located on the internet, and then delivering the Word file
to a user behind a properly configured firewall (i.e., outbound SMB
connections are blocked) would not allow the exploit to fire.
David LeBlanc
dleblanc@mindspring.com
