Microsoft PowerPoint Remote Denial of Service Vulnerability

Bugtraq ID:	20495
Class:	Boundary Condition Error
CVE:	CVE-2006-5296
Remote:	Yes
Local:	No
Published:	Oct 12 2006 12:00AM
Updated:	Jun 27 2007 03:48AM
Credit:	Nanika is credited with the discovery of this vulnerability.
Vulnerable:	Microsoft PowerPoint 2003 SP3 + Microsoft Office 2003 SP3 Microsoft PowerPoint 2003 SP2 + Microsoft Office 2003 SP2 Microsoft PowerPoint 2003 SP1 + Microsoft Office 2003 SP1 Microsoft PowerPoint 2003 0 + Microsoft Office 2003 0 Microsoft Office 2004 for Mac 0 Microsoft Office 2003 SP3 Microsoft Office 2003 SP2 Microsoft Office 2003 SP1 Microsoft Office 2003 0 + Microsoft Excel 2003 + Microsoft FrontPage 2003 + Microsoft InfoPath 2003 + Microsoft OneNote 2003 0 + Microsoft Outlook 2003 0 + Microsoft PowerPoint 2003 0 + Microsoft Publisher 2003
Not Vulnerable:

Microsoft PowerPoint Remote Denial of Service Vulnerability

Microsoft PowerPoint is prone to a remote denial-of-service vulnerability.

Successfully exploiting this issue allows a remote attacker to crash the affected application.

This issue was first reported as a remote code-execution vulnerability. Microsoft's Secure Windows Initiative is now reporting that this issue is not exploitable for remote code execution. Further research has indicated that the issue is caused by a NULL-pointer dereference that apparently cannot be exploited to execute code, yet can be used to predictably crash the application.

Microsoft PowerPoint Remote Denial of Service Vulnerability

The following exploit is available:

• /data/vulnerabilities/exploits/20495.pl

Microsoft PowerPoint Remote Denial of Service Vulnerability

Solution:
The Microsoft Secure Windows Initiative has stated that an update addressing this vulnerability will be released in the next PowerPoint ship vehicle.

Microsoft PowerPoint Remote Denial of Service Vulnerability

References:

• Bloodhound.Exploit.93 (Symantec)
  
• Microsoft Office Product Homepage (Microsoft)
  
• PoC published for MS Office 2003 PowerPoint (Microsoft)
  
• Follow up information on weblog posting about PoC published for MS Office 2003 P (Microsoft Security Response Center Blog)