PT-2006-1124 · Microsoft · Office 2000+5

Published 2006-07-11 · Updated 2018-10-12 · CVE-2006-0033

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Microsoft Office 2003 versions SP1 through SP2 Microsoft Office XP version SP3 Microsoft Office 2000 version SP3

Description: A remote code execution issue exists in Office, allowing attackers to execute arbitrary code when a crafted PNG image is parsed, potentially leading to memory corruption. This issue can be exploited when Office opens a malformed PNG file. If a user with administrative rights is logged on, a successful exploitation could grant an attacker complete control of the affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights. Users with fewer user rights on the system may be less affected than those operating with administrative user rights.

Recommendations: For Microsoft Office 2003 versions SP1 through SP2, update to a version that includes the fix for this issue. For Microsoft Office XP version SP3, update to a version that includes the fix for this issue. For Microsoft Office 2000 version SP3, update to a version that includes the fix for this issue. As a temporary workaround, consider avoiding the use of PNG images in Office until a patch is available.

Fix

Related Identifiers

CVE-2006-0033

Affected Products

Office 2000

Office 2003

Office Xp

Office

Office Onenote

Office Project

References · 13

• http://vupen.com/english/advisories/2006/2757 · Vendor Advisory
• http://securityfocus.com/bid/18913 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2006-0033 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0033 · Security Note
• http://secunia.com/advisories/21013 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-039 · Vendor Advisory
• http://osvdb.org/27147 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A163 · Note
• http://fortinet.com/FortiGuardCenter/advisory/FG-2006-22.html · Note
• http://us-cert.gov/cas/techalerts/TA06-192A.html · Note
• http://securitytracker.com/id?1016470 · Note
• http://kb.cert.org/vuls/id/459388 · Note
• http://technet.microsoft.com/library/security/ms06-039 · Note