Microsoft Word Mac Remote Code Execution Vulnerability

Bugtraq ID:	20387
Class:	Design Error
CVE:	CVE-2006-4693
Remote:	Yes
Local:	No
Published:	Oct 10 2006 12:00AM
Updated:	Oct 13 2006 05:19PM
Credit:	Microsoft credits Cu Fang with the discovery of this vulnerability.
Vulnerable:	Microsoft Word X for Mac Microsoft Word 2004 for Mac 0
Not Vulnerable:

Microsoft Word Mac Remote Code Execution Vulnerability

Microsoft Word for Mac is prone to a remote code-execution vulnerability when parsing Word files. Exploiting this vulnerability may allow an attacker to execute arbitrary machine code in the context of the user who opened the file.

An attacker could leverage this issue to gain the permissions of an unsuspecting user. A successful exploit could result in the remote compromise of the affected system.

Microsoft Word Mac Remote Code Execution Vulnerability

To exploit this vulnerability, an attacker must entice a user to open a malicious file.

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]

Microsoft Word Mac Remote Code Execution Vulnerability

Solution:
Microsoft has released fixes to address this issue. Please see the references for information on how to obtain and apply these fixes.

Microsoft Word Mac Remote Code Execution Vulnerability

References:

• Word 2004 for Mac Homepage (Microsoft)
  
• Microsoft Security Bulletin MS06-060 (Microsoft)