Thread-topic: [SA24152] Microsoft RichEdit OLE Dialog Memory Corruption Vulnerability
> ----------------------------------------------------------------------
>
> TITLE:
> Microsoft RichEdit OLE Dialog Memory Corruption Vulnerability
>
> SECUNIA ADVISORY ID:
> SA24152
>
> VERIFY ADVISORY:
>
>
> CRITICAL:
> Moderately critical
>
> IMPACT:
> System access
>
> WHERE:
> From remote
>
> OPERATING SYSTEM:
> Microsoft Windows 2000 Advanced Server
>
> Microsoft Windows 2000 Datacenter Server
>
> Microsoft Windows 2000 Professional
>
> Microsoft Windows 2000 Server
>
> Microsoft Windows Server 2003 Datacenter Edition
>
> Microsoft Windows Server 2003 Enterprise Edition
>
> Microsoft Windows Server 2003 Standard Edition
>
> Microsoft Windows Server 2003 Web Edition
>
> Microsoft Windows Storage Server 2003
>
> Microsoft Windows XP Home Edition
>
> Microsoft Windows XP Professional
>
>
> SOFTWARE:
> Microsoft Access 2000
>
> Microsoft Access 2002
>
> Microsoft Access 2003
>
> Microsoft Excel 2000
>
> Microsoft Excel 2002
>
> Microsoft Excel 2003
>
> Microsoft Frontpage 2000
>
> Microsoft Frontpage 2002
>
> Microsoft Frontpage 2003
>
> Microsoft InfoPath 2003
>
> Microsoft Office 2000
>
> Microsoft Office 2003 Professional Edition
>
> Microsoft Office 2003 Proofing Tools
>
> Microsoft Visio 2003
>
> Microsoft OneNote 2003
>
> Microsoft Outlook 2000
>
> Microsoft Outlook 2002
>
> Microsoft Outlook 2003
>
> Microsoft Word 2003 Viewer
>
> Microsoft Word 2003
>
> Microsoft Word 2002
>
> Microsoft Word 2000
>
> Microsoft Visio 2002
>
> Microsoft Project 2002
>
> Microsoft Project 2003
>
> Microsoft Publisher 2000
>
> Microsoft Publisher 2002
>
> Microsoft Publisher 2003
>
> Microsoft Office 2004 for Mac
>
>
> DESCRIPTION:
> A vulnerability has been reported in Microsoft Windows and Microsoft
> Office, which can be exploited by malicious people to compromise a
> users system.
>
> The vulnerability is caused due to an error in RichEdit components
> handling of OLE objects in RTF (Rich Text Format) files. This can be
> exploited to cause a memory corruption by e.g. tricking a user into
> opening a malicious RTF document using a Microsoft Office application
> and interact with a specially crafted, embedded OLE object.
>
> SOLUTION:
> Apply patches.
>
> Microsoft Windows 2000 Service Pack 4:
>
> 3d3-b2fb-4cf4-8ee1-51871d39eecd
>
> Microsoft Windows XP Service Pack 2:
>
> 28d-7212-4bf0-9699-3dbae5db6ca1
>
> Microsoft Windows XP Professional x64 Edition:
>
> 7ac-20b4-4ec9-9467-2ddd4fc493d6
>
> Microsoft Windows Server 2003 (with or without SP1):
>
> 355-d5c5-406d-9322-5fe1b2134d2f
>
> Microsoft Windows Server 2003 for Itanium-based Systems (with or
> without SP1):
>
> 20f-4c0b-48f7-a1f9-613265506835
>
> Microsoft Windows Server 2003 x64 Edition:
>
> 258-b636-455b-8833-74dea6269e24
>
> Microsoft Office 2000 Service Pack 3:
> (KB920906)
>
> E78-2A08-45C9-A7AC-09678D060439
>
> Microsoft Office XP Service Pack 3:
> (KB920816)
>
> 62C-FC35-40B4-AD04-ADD247950423
>
> Microsoft Office 2003 Service Pack 2:
> (KB920813)
>
> AB8-0C99-4BE6-8DE7-71D463473A4A
>
> Microsoft Project 2000 Service Release 1:
> (KB920906)
>
> 1FC-00B8-451C-AB3C-772780D4C46A
>
> Microsoft Office 2000 Multilanguage Packs:
> (KB920906)
>
> 7F8-74D2-4184-9986-23AB3C4EF7F2
>
> Microsoft Project 2002 Service Pack 1:
> (KB920816)
>
> 366-C5E7-4850-B773-1FE669FAEEAF
>
> Microsoft Visio 2002 Service Pack 2:
> (KB920816)
>
> 182-0997-46BC-94AC-B4B0A523C51C
>
> Microsoft Learning Essentials 1.0, 1.1, and 1.5 for Microsoft
> Office:
> (KB929437)
>
> D5B-1CB3-4FED-B08C-C31A88A75EBD
>
> Microsoft Global Input Method Editor for Office 2000 (Japanese):
> (KB920906)
>
> E78-2A08-45C9-A7AC-09678D060439
>
> Microsoft Office 2004 for Mac:
> (KB932185)
>
>
> PROVIDED AND/OR DISCOVERED BY:
> The vendor credits:
> * Kostya Kortchinsky of Immunity, Inc.
> * Fabrice Desclaux of EADS Common Research Center.
>
> ORIGINAL ADVISORY:
> MS07-013 (KB918118):
>
>
