Microsoft Word Malformed Document Denial Of Service Vulnerability

Bugtraq ID:	16782
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Feb 22 2006 12:00AM
Updated:	Feb 23 2006 09:52PM
Credit:	Discovery is credited to <[email protected]>.
Vulnerable:	Microsoft Word 2003 + Microsoft Office 2003 SP1 + Microsoft Office 2003 0
Not Vulnerable:

Microsoft Word Malformed Document Denial Of Service Vulnerability

Microsoft Word is susceptible to a denial-of-service vulnerability. The specific cause of this issue is currently unknown.

This issue allows attackers to crash affected applications. Due to the unspecified cause of this issue, attackers may be able to execute arbitrary code in the context of the affected application, but this has not been confirmed.

Microsoft Word 2003 is reportedly vulnerable; other versions may also be affected.

This BID will be updated as further information is disclosed.

Microsoft Word Malformed Document Denial Of Service Vulnerability

This issue was discovered by using a file-fuzzer (101_filefuzz) designed to create random input to the targeted application. It is not currently known if the fuzzer application is publicly available.

Microsoft Word Malformed Document Denial Of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]

Microsoft Word Malformed Document Denial Of Service Vulnerability

References:

• [Dailydave] word dos 4fun ([email protected])
  
• Microsoft PowerPoint Home Page (Microsoft)