PT-2007-2627 · Microsoft · Office 2000+4

Published 2007-05-08 · Updated 2018-10-16 · CVE-2007-1202

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Word versions in Office 2000 SP3, XP SP3, 2003 SP2, 2004 for Mac, and Works Suite 2004, 2005, and 2006

Description The issue is related to the improper parsing of certain rich text "property strings of certain control words" in Microsoft Word, which can lead to heap corruption and allow remote attackers to execute arbitrary code. This can be triggered by a specially crafted Word file, potentially included as an email attachment or hosted on a malicious website.

Recommendations For Microsoft Word in Office 2000 SP3, update to a version that includes the fix for this issue. For Microsoft Word in Office XP SP3, update to a version that includes the fix for this issue. For Microsoft Word in Office 2003 SP2, update to a version that includes the fix for this issue. For Microsoft Word 2004 for Mac, update to a version that includes the fix for this issue. For Microsoft Word in Works Suite 2004, 2005, and 2006, update to a version that includes the fix for this issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2007-1202

Affected Products

Office Word

Office 2000

Office 2003

Office Xp

Works Suite

References · 15

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-024 · Vendor Advisory
• http://securitytracker.com/id?1018013 · Patch
• http://securityfocus.com/archive/1/468871/100/200/threaded · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1202 · Security Note
• http://securityfocus.com/bid/23836 · Patch
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=525 · Patch
• http://vupen.com/english/advisories/2007/1709 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-1202 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1202 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1900 · Note
• http://us-cert.gov/cas/techalerts/TA07-128A.html · Note
• http://kb.cert.org/vuls/id/555489 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2007/ms07-024 · Note
• http://osvdb.org/34388 · Note
• http://frsirt.com/english/advisories/2007/1709 · Note