PT-2002-1749 · Microsoft · Office Web Components

Published 2002-09-24 · Updated 2018-10-12 · CVE-2002-0727

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Office Web Components (OWC) versions 2000 through 2002

Description The issue concerns the Host function in Microsoft Office Web Components, which is exposed in components marked as safe for scripting. This exposure allows remote attackers to execute arbitrary commands via the setTimeout method.

Recommendations For Microsoft Office Web Components (OWC) versions 2000 through 2002, consider disabling the Host function in components marked as safe for scripting as a temporary workaround until a patch is available. Restrict access to the setTimeout method to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2002-0727

Affected Products

Office Web Components

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2002-0727 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-044 · Vendor Advisory
• http://iss.net/security_center/static/8777.php · Vendor Advisory
• http://osvdb.org/3006 · Note
• http://marc.info/?l=bugtraq&m=101829645415486&w=2 · Note
• http://securityfocus.com/bid/4449 · Note