PT-2006-1103 · Microsoft · Office 2000+5
Publicado
2006-07-11
·
Atualizado
2018-10-19
·
CVE-2006-0007
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
Microsoft Office 2003 versions SP1 through SP2
Microsoft Office XP version SP3
Microsoft Office 2000 version SP3
Description:
A buffer overflow in GIFIMP32.FLT, used by Microsoft Office, allows user-assisted attackers to execute arbitrary code via a crafted GIF image that triggers memory corruption when it is parsed. This issue can be exploited when a user opens a malformed GIF file, potentially allowing an attacker to take complete control of an affected system if the user has administrative user rights. The attacker could then install programs, view, change, or delete data, or create new accounts with full user rights. Users with fewer user rights on the system could be less affected than those operating with administrative user rights.
Recommendations:
For Microsoft Office 2003 versions SP1 and SP2, update to a version that includes the fix for this issue.
For Microsoft Office XP version SP3, update to a version that includes the fix for this issue.
For Microsoft Office 2000 version SP3, update to a version that includes the fix for this issue.
As a temporary workaround, consider avoiding the use of GIF images from untrusted sources until a patch is available.
Correção
RCE
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Office 2000
Office 2003
Office Xp
Office
Office Onenote
Office Project