Microsoft Powerpoint Multiple Unspecified Vulnerabilities

Bugtraq ID:	18993
Class:	Unknown
CVE:	CVE-2006-3655 CVE-2006-3656 CVE-2006-3660
Remote:	Yes
Local:	No
Published:	Jul 14 2006 12:00AM
Updated:	Jul 18 2006 11:08PM
Credit:	naveed <[email protected]> discovered these issues.
Vulnerable:	Microsoft PowerPoint 2003 SP2 + Microsoft Office 2003 SP2 Microsoft PowerPoint 2003 SP1 + Microsoft Office 2003 SP1 Microsoft PowerPoint 2003 0 + Microsoft Office 2003 0
Not Vulnerable:

Microsoft Powerpoint Multiple Unspecified Vulnerabilities

Microsoft PowerPoint is prone to multiple remote vulnerabilities.

Three proof-of-concept exploit files designed to trigger vulnerabilities in PowerPoint have been released.

It is currently unknown if these three exploit files pertain to newly discovered, unpublished vulnerabilities or if they exploit previously disclosed issues. These issues may allow remote attackers to cause crashes or to execute arbitrary machine code in the context of the affected application, but this has not been confirmed.

This BID will be updated and potentially split into individual records as further analysis is completed.

Microsoft PowerPoint 2003 is vulnerable to these issues; other versions may also be affected.

Microsoft Powerpoint Multiple Unspecified Vulnerabilities

The following proof-of-concept exploit files are available to demonstrate these issues:

• /data/vulnerabilities/exploits/powerpoint-1.c
• /data/vulnerabilities/exploits/powerpoint-2.c
• /data/vulnerabilities/exploits/powerpoint-3.c

Microsoft Powerpoint Multiple Unspecified Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

Microsoft Powerpoint Multiple Unspecified Vulnerabilities

References:

• Microsoft PowerPoint Home Page (Microsoft)
  
• Microsoft Technet Security (Microsoft)