Vulnerability Name: CVE-2006-2387 (CCN-29238) Assigned: 2006-10-10 Published: 2006-10-10 Updated: 2018-10-30 Summary: Unspecified vulnerability in Microsoft Excel 2000, 2002, 2003, 2004 for Mac, v.X for Mac, Excel Viewer 2003, and Microsoft Works Suite 2004 through 2006 allows user-assisted attackers to execute arbitrary code via a crafted DATETIME record in an XLS file, a different vulnerability than CVE-2006-3867 and CVE-2006-3875 . CVSS v3 Severity: 5.6 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L Exploitability Metrics: Attack Vector (AV): NetworkAttack Complexity (AC): HighPrivileges Required (PR): NoneUser Interaction (UI): NoneScope: Scope (S): UnchangedImpact Metrics: Confidentiality (C): LowIntegrity (I): LowAvailibility (A): Low
CVSS v2 Severity: 5.1 Medium (CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P 3.8 Low (Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C Exploitability Metrics: Access Vector (AV): NetworkAccess Complexity (AC): HighAuthentication (Au): NoneImpact Metrics: Confidentiality (C): PartialIntegrity (I): PartialAvailibility (A): Partial
5.1 Medium (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P 3.8 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C Exploitability Metrics: Access Vector (AV): NetworkAccess Complexity (AC): HighAthentication (Au): NoneImpact Metrics: Confidentiality (C): PartialIntegrity (I): PartialAvailibility (A): Partial
Vulnerability Type: CWE-noinfo Vulnerability Consequences: Gain Access References: Source: MITRECVE-2006-2387 Microsoft Excel DATETIME/COLINFO Record Errors and Lotus 1-2-3 Errors Let Remote Users Execute Arbitrary Code 1017031 Windows Security Updates for October 2006 - (MS06-056 - MS06-065) Vulnerability in Microsoft Excel Could Allow Remote Code Execution (2640241) Vulnerability in Microsoft Office Could Allow for Remote Code Execution (2639185) Vulnerability in Microsoft Word Could Allow Remote Code Execution (2680352) Combined Security Update for Microsoft Office, Windows, .NET Framework, and Silverlight (2681578) Vulnerability in Microsoft Office Could Allow for Remote Code Execution (2731879) Vulnerabilities in Microsoft Word Could Allow Remote Code Execution (2742319) Vulnerability in Microsoft Works Could Allow Remote Code Execution (KB2754670) Vulnerability in SQL Server Could Allow Elevation of Privilege (2754849) Vulnerability in Microsoft Word Could Allow Remote Code Execution (2780642) Vulnerability in Silverlight Could Allow Remote Code Execution (2814124) Vulnerability in Microsoft Word Could Allow Remote Code Execution (2830399) Vulnerability in Windows Components Could Allow Remote Code Execution (2848295) Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (2845537) Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (2885080) Vulnerabilities in Microsoft Word Could Allow Remote Code Execution (2885084) Vulnerabilities in Microsoft Word and Office Web Apps Could Allow Remote Code Execution (2916605) Vulnerabilities in Microsoft Word and Office Web Apps Could Allow Remote Code Execution (2949660) Vulnerability in Microsoft Word Could Allow Remote Code Execution (2969261) Vulnerability in Windows Journal Could Allow Remote Code Execution (2975689) Vulnerabilities in SQL Server Could Allow Elevation of Privilege (2984340) Vulnerability in Microsoft Word and Office Web Apps Could Allow Remote Code Execution (3000434) Vulnerability in Microsoft Office Could Allow Remote Code Execution (3009710) Vulnerabilities in Microsoft Word and Office Web Apps Could Allow Remote Code Execution (3017301) Vulnerabilities in MicrosoftExcel Could Allow Remote Code Execution (3017347) Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (3080790) Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (3089664) Security Updates for Microsoft Office (3096440) Security Updates for Microsoft Office to Address Remote Code Execution (3104540) Security Update for Microsoft Office to Address Remote Code Execution (3116111) Security Update for Microsoft Office to Address Remote Code Execution - Critical (3124585) Security Update for Microsoft Office to Address Remote Code Execution (3134226) Security Update for Microsoft Office to Address Remote Code Execution (3141806) Security Update for Microsoft Office (3148775) Security Update for Microsoft Office (3155544) Security Update for Office (3163610) Security Updates for Office (3170008) Security Update for Office (3177451) Security Update for Microsoft Office (3185852) Security Update for Microsoft Office (3194063) Security Update for Microsoft Office (3199168) Security Update for Microsoft Office (3204068) Security Update for Microsoft Office (3214291) Security Update for Microsoft Graphics Component (4013075) Security Update for Microsoft Office (4013241) Microsoft Excel fails to properly process malformed DATETIME records VU#706668 Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (924164) Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (927198) Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (934233) Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (936542) Vulnerability in Microsoft Excel Could Allow Remote Code Execution (940965) Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (949029) Vulnerabilities in Microsoft Word Could Allow Remote Code Execution (951207) Vulnerability in Microsoft Word Could Allow Remote Code Execution (955048) Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (954066) Vulnerabilities in Microsoft PowerPoint Could Allow Remote Code Execution (949785) Vulnerabilities in GDI+ Could Allow Remote Code Execution (954593) Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (956416) Vulnerability in Microsoft SQL Server Could Allow Remote Code Execution (959420) Vulnerabilities in Microsoft Office PowerPoint Could Allow Remote Code Execution (967340) Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution (969462) Vulnerabilities in GDI+ Could Allow Remote Code Execution (957488) Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution (972652) Vulnerability in Microsoft Office (MSO) Could Allow Remote Code Execution (978214) Vulnerabilities in Microsoft Office PowerPoint Could Allow Remote Code Execution (975416) Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution (980150) Vulnerabilities in Microsoft Visio Could Allow Remote Code Execution (980094) Vulnerabilities in COM validation in Microsoft Office Could Allow Remote Code Execution (983235 Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution (2027452) Vulnerabilities in Microsoft Office Word Could Allow Remote Code Execution (2269638) Vulnerability in Microsoft Office Excel Could Allow Remote Code Execution (2269707) Vulnerabilities in Microsoft Word Could Allow Remote Code Execution (2293194) Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (2423930) Vulnerabilities in Microsoft Office Graphics Filters Could Allow for Remote Code Execution (968095) Vulnerabilities in Microsoft Visio Could Allow Remote Code Execution (2451879) Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (2489279) Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (2489293) Vulnerability in GDI+ Could Allow Remote Code Execution (2489979) Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (2537146) Vulnerability in the Microsoft XML Editor Could Allow Information Disclosure (2543893) Vulnerabilities in Microsoft Visio Could Allow Remote Code Execution (2560978) Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (2587505) 20061010 ZDI-06-033: Microsoft Office Excel File Format DATETIME Record Parsing Vulnerability SSRT061264 20344 Microsoft Excel DATETIME Remote Code Execution Vulnerability ADV-2006-3978 http://www.zerodayinitiative.com/advisories/ZDI-06-033.html MS06-059 excel-datetime-bo(29238) oval:org.mitre.oval:def:570 Microsoft Office Excel File Format DATETIME Record Parsing Vulnerability Vulnerable Configuration: Configuration 1 :cpe:/a:microsoft:office:2000:*:*:*:*:*:*:* OR cpe:/a:microsoft:office:2000:*:*:ja:*:*:*:* OR cpe:/a:microsoft:office:2000:*:*:ko:*:*:*:* OR cpe:/a:microsoft:office:2000:*:*:zh:*:*:*:* OR cpe:/a:microsoft:office:2000:sp1:*:*:*:*:*:* OR cpe:/a:microsoft:office:2000:sp2:*:*:*:*:*:* OR cpe:/a:microsoft:office:2000:sp3:*:*:*:*:*:* OR cpe:/a:microsoft:office:2001:*:*:*:*:*:*:* OR cpe:/a:microsoft:office:2001:*:macintosh:*:*:*:*:* OR cpe:/a:microsoft:office:2001:*:macos:*:*:*:*:* OR cpe:/a:microsoft:office:2001:sr1:mac_os:*:*:*:*:* OR cpe:/a:microsoft:office:2003:*:*:*:*:*:*:* OR cpe:/a:microsoft:office:2003:sp1:*:*:*:*:*:* OR cpe:/a:microsoft:office:2003:sp2:*:*:*:*:*:* OR cpe:/a:microsoft:office:2003:sp3:*:*:*:*:*:* OR cpe:/a:microsoft:office:2004:*:mac:*:*:*:*:* OR cpe:/a:microsoft:office:v.x:*:*:*:*:*:*:* Configuration CCN 1 :cpe:/a:microsoft:excel:2000:*:*:*:*:*:*:* OR cpe:/a:microsoft:excel:2002:*:*:*:*:*:*:* OR cpe:/a:microsoft:works:2003:*:*:*:*:*:*:* OR cpe:/a:microsoft:works:2004:*:*:*:*:*:*:* OR cpe:/a:microsoft:office:xp:sp3:*:*:*:*:*:* OR cpe:/a:microsoft:excel:2003:*:*:*:*:*:*:* OR cpe:/a:microsoft:office:2000:sp3:*:*:*:*:*:* OR cpe:/a:microsoft:office:2003:sp1:*:*:*:*:*:* OR cpe:/a:microsoft:office:2003:sp2:*:*:*:*:*:* OR cpe:/a:microsoft:works:2005:*:*:*:*:*:*:* OR cpe:/a:microsoft:works:2006:*:*:*:*:*:*:* OR cpe:/a:microsoft:office:2004:*:*:*:*:*:*:* OR cpe:/a:microsoft:excel_viewer:2003:*:*:*:*:*:*:* Oval Definitions BACK
microsoft office 2000
microsoft office 2000
microsoft office 2000
microsoft office 2000
microsoft office 2000 sp1
microsoft office 2000 sp2
microsoft office 2000 sp3
microsoft office 2001
microsoft office 2001
microsoft office 2001
microsoft office 2001 sr1
microsoft office 2003
microsoft office 2003 sp1
microsoft office 2003 sp2
microsoft office 2003 sp3
microsoft office 2004
microsoft office v.x
microsoft excel 2000
microsoft excel 2002
microsoft works 2003
microsoft works 2004
microsoft office xp sp3
microsoft excel 2003
microsoft office 2000 sp3
microsoft office 2003 sp1
microsoft office 2003 sp2
microsoft works 2005
microsoft works 2006
microsoft office 2004
microsoft excel viewer 2003
Denotes that component is vulnerable