PT-2006-4516 · Microsoft · Visio 2002+10

Ka Chun Leung · Published 2006-08-08 · Updated 2018-10-12 · CVE-2006-3649

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Visual Basic for Applications (VBA) SDK versions 6.0 through 6.4 Microsoft Office 2000 SP3 Microsoft Office XP SP3 Microsoft Project 2000 SR1 Microsoft Project 2002 SP1 Microsoft Access 2000 Runtime SP3 Microsoft Visio 2002 SP2 Microsoft Works Suite versions 2004 through 2006

Description A remote code execution issue exists in the way Visual Basic for Applications (VBA) checks document properties when opening a document. This could allow an attacker to take complete control of the affected system. The issue arises when VBA is invoked to open documents with unspecified properties that are not verified.

Recommendations For Microsoft Visual Basic for Applications (VBA) SDK versions 6.0 through 6.4, update to a version outside of this range to mitigate the risk. For Microsoft Office 2000 SP3, consider disabling VBA invocation for document opening until a patch is available. For Microsoft Office XP SP3, restrict access to document properties to minimize the risk of exploitation. For Microsoft Project 2000 SR1 and Microsoft Project 2002 SP1, avoid using VBA for opening documents with unspecified properties until the issue is resolved. For Microsoft Access 2000 Runtime SP3 and Microsoft Visio 2002 SP2, consider applying configuration changes to limit VBA's ability to execute arbitrary code. For Microsoft Works Suite versions 2004 through 2006, update to a version outside of this range or apply mitigation measures as recommended for other affected products.

Fix

Related Identifiers

CVE-2006-3649

Affected Products

Access 2000 Runtime

Office

Office 2000

Office Project

Office Visio

Office Xp

Project 2000

Project 2002

Visio 2002

Visual Basic For Applications (Vba) Sdk

Works Suite

References · 13

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-047 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-3649 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3649 · Security Note
• http://kb.cert.org/vuls/id/159484 · Patch
• http://us-cert.gov/cas/techalerts/TA06-220A.html · Patch
• https://docs.microsoft.com/security-updates/securitybulletins/2006/MS06-047 · Note
• http://securityfocus.com/bid/19414 · Note
• http://secunia.com/advisories/21408 · Note
• http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:694 · Note
• http://securitytracker.com/id?1016656 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A694 · Note
• http://vupen.com/english/advisories/2006/3214 · Note
• http://frsirt.com/english/advisories/2006/3214 · Note