Technical Description

Multiple vulnerabilities have been identified in Microsoft Excel, which could be exploited by attackers to take complete control of an affected system. These issues are due to memory corruption errors when processing documents containing malformed records (i.e. IMDATA, Column, or Palette) and strings, which could be exploited by attackers to execute arbitrary commands by tricking a user into opening a specially crafted presentation.

Affected Products

Microsoft Office 2000 Service Pack 3
Microsoft Office XP Service Pack 3
Microsoft Office 2003 Service Pack 2
Microsoft Office Excel Viewer 2003
Microsoft Excel 2002
Microsoft Excel 2000
Microsoft Excel 2003
Microsoft Works Suite 2004
Microsoft Works Suite 2005
Microsoft Office 2004 for Mac
Microsoft Office v. X for Mac

Solution

Security update for Microsoft Excel 2000 :
http://www.microsoft.com/downloads/details.aspx?familyid=5CCF4455-6B22-4249-93D7-661D12839292

Security update for Microsoft Excel 2002 :
http://www.microsoft.com/downloads/details.aspx?FamilyId=EE7278EA-3AEE-4994-9657-66019961D63C

Security update for Microsoft Excel 2003 :
http://www.microsoft.com/downloads/details.aspx?FamilyId=79B88CE8-5C56-462F-AC1A-4BCE04C8F543

Security update for Microsoft Office Excel Viewer 2003 :
http://www.microsoft.com/downloads/details.aspx?FamilyId=99AE7653-F0FD-4DBA-A151-098FD03E6EA4

Security update for Microsoft Works Suite 2004 :
http://www.microsoft.com/downloads/details.aspx?FamilyId=EE7278EA-3AEE-4994-9657-66019961D63C

Security update for Microsoft Works Suite 2005 :
http://www.microsoft.com/downloads/details.aspx?FamilyId=EE7278EA-3AEE-4994-9657-66019961D63C

Security update for Microsoft Office 2004 and Office v. X for Mac :
http://www.microsoft.com/mac/

References

http://www.vupen.com/english/advisories/2007/0103
http://www.microsoft.com/technet/security/Bulletin/MS07-002.mspx

Credits

Vulnerabilities reported by Jeff Gennari (CERT), Jie Ma (Fortinet Security Research Team), NSFocus Security Team, and Greg MacManus (iDefense Labs).

ChangeLog

2007-01-09 : Initial release

Vulnerability Management

Subscribe to VUPEN VNS and receive real-time alerts when new advisories or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.