PT-2006-4324 · Microsoft · Office Powerpoint

Arnaud Dovi · Published 2006-10-10 · Updated 2018-10-30 · CVE-2006-3435

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Office PowerPoint versions in Office 2000, XP, 2003, 2004 for Mac, and v.X for Mac

Description The issue arises from the improper parsing of the slide notes field in a document, allowing remote user-assisted attackers to execute arbitrary code via crafted data in this field. This triggers an erroneous object pointer calculation that uses data from within the document. A remote code execution vulnerability exists when PowerPoint parses a file that includes a malformed object pointer.

Recommendations For Microsoft Office PowerPoint versions in Office 2000, XP, 2003, 2004 for Mac, and v.X for Mac, consider avoiding the use of crafted or potentially malicious files until a patch is available. As a temporary workaround, restrict access to potentially malicious PowerPoint files to minimize the risk of exploitation.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2006-3435

Affected Products

Office Powerpoint

References · 17

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3435 · Security Note
• http://vupen.com/english/advisories/2006/3977 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-3435 · Security Note
• http://securityfocus.com/archive/1/449179/100/0/threaded · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-058 · Vendor Advisory
• http://osvdb.org/29446 · Note
• http://securityfocus.com/archive/1/448149/100/0/threaded · Note
• http://frsirt.com/english/advisories/2006/3977 · Note
• http://securityfocus.com/bid/20304 · Note
• http://securityfocus.com/archive/1/archive/1/449179/100/0/threaded · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A476 · Note
• http://securitytracker.com/id?1017030 · Note
• http://securityfocus.com/archive/1/archive/1/448149/100/0/threaded · Note
• http://zerodayinitiative.com/advisories/ZDI-06-032.html · Note
• http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:476 · Note