Oval Definition:	oval:org.mitre.oval:def:639
Revision Date: 2012-05-28 Version: 7 Title: Microsoft Office Malformed String Parsing Vulnerability Description: MSO.DLL in Microsoft Office 2000, Office XP (2002), and Office 2003 allows user-assisted attackers to cause a denial of service and execute arbitrary code via multiple attack vectors, as originally demonstrated using a crafted document record with a malformed string, as demonstrated by replacing a certain "01 00 00 00" byte sequence with an "FF FF FF FF" byte sequence, possibly causing an invalid array index, in (1) an Excel .xls document, which triggers an access violation in ole32.dll; (2) an Excel .xlw document, which triggers an access violation in excel.exe; (3) a Word document, which triggers an access violation in mso.dll in winword.exe; and (4) a PowerPoint document, which triggers an access violation in powerpnt.txt. NOTE: after the initial disclosure, this issue was demonstrated by triggering an integer overflow using an inconsistent size for a Unicode "Sheet Name" string. Family: windows Class: vulnerability Status: ACCEPTED Reference(s): CVE-2006-1540 Platform(s): Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Windows XP Product(s): Microsoft Office Definition Synopsis Microsoft Office 2000 Microsoft Office 2000 is installed AND The Office 2000 (or later) version of Mso9.dll is installed. AND the version of Mso9.dll is less than 9.0.0.8944 OR Microsoft Office XP Microsoft Office XP is installed AND The Office XP (or later) version of Mso.dll is installed. AND the version of Mso.dll is less than 10.0.6804.0. OR Microsoft Office 2003 Microsoft Office 2003 is installed AND The Office 2003 (or later) version of Mso.dll is installed. AND the version of Mso.dll is less than 11.0.8028.0. OR Microsoft Project 2000 Microsoft Project 2000 SR1 is installed AND The Office 2000 (or later) version of Mso9.dll is installed. AND the version of Mso9.dll is less than 9.0.0.8944 OR Microsoft Project 2002 Microsoft Project 2002 SP1 is installed AND The Office XP (or later) version of Mso.dll is installed. AND the version of Mso.dll is less than 10.0.6804.0. OR Microsoft Office Visio 2002 Microsoft Office Visio 2002 SP2 is installed AND The Office XP (or later) version of Mso.dll is installed. AND the version of Mso.dll is less than 10.0.6804.0. OR Microsoft Word Viewer Microsoft Word Viewer is installed AND The Office 2003 (or later) version of Mso.dll is installed. AND the version of Mso.dll is less than 11.0.8028.0. OR Microsoft Excel Viewer 2003 Microsoft Excel Viewer 2003 is installed AND The Office 2003 (or later) version of Mso.dll is installed. AND the version of Mso.dll is less than 11.0.8028.0.
BACK