Thread-topic: [SA21863] Microsoft Publisher Code Execution Vulnerability
>
> TITLE:
> Microsoft Publisher Code Execution Vulnerability
>
> SECUNIA ADVISORY ID:
> SA21863
>
> VERIFY ADVISORY:
>
>
> CRITICAL:
> Highly critical
>
> IMPACT:
> System access
>
> WHERE:
> From remote
>
> SOFTWARE:
> Microsoft Office 2000
>
> Microsoft Office 2003 Professional Edition
>
> Microsoft Office 2003 Small Business Edition
>
> Microsoft Office 2003 Standard Edition
>
> Microsoft Office 2003 Student and Teacher Edition
>
> Microsoft Office XP
>
> Microsoft Publisher 2000
>
> Microsoft Publisher 2002
>
> Microsoft Publisher 2003
>
>
> DESCRIPTION:
> A vulnerability has been reported in Microsoft Publisher, which can
> be exploited by malicious people to compromise a user's system.
>
> The vulnerability is caused due to a memory corruption error in
> Publisher when parsing ".pub" files with malformed strings and can be
> exploited via a specially crafted document.
>
> Successful exploitation allows execution of arbitrary code.
>
> SOLUTION:
> Apply patches.
>
> Microsoft Office 2000 SP3:
>
26B-596F-4E84-99FD-03554AC55213
>
> Microsoft Office XP SP3:
>
9FB-2CD5-4A50-95F6-54846D39B6EA
>
> Microsoft Office 2003 SP1/SP2:
>
3F1-E2B6-4B78-98A1-E8B04242438A
>
> PROVIDED AND/OR DISCOVERED BY:
> The vendor credits Stuart Pearson, Computer Terrorism.
>
> ORIGINAL ADVISORY:
> MS06-054 (KB910729):
>
>
