Microsoft Office Publisher Invalid Memory Reference Remote Code Execution Vulnerability

Bugtraq ID:	22702
Class:	Input Validation Error
CVE:	CVE-2007-1117 CVE-2007-1754
Remote:	Yes
Local:	No
Published:	Feb 23 2007 12:00AM
Updated:	Jul 05 2016 09:38PM
Credit:	eEye Research is credited with the discovery of this vulnerability.
Vulnerable:	Microsoft Publisher 2007 0 Microsoft Office 2007 0 + Microsoft Access 2007 0 + Microsoft Access 2007 0 + Microsoft Excel 2003 + Microsoft Excel 2007 0 + Microsoft Excel 2007 0 + Microsoft FrontPage 2003 + Microsoft Groove 2007 0 + Microsoft Groove 2007 0 + Microsoft InfoPath 2003 + Microsoft InfoPath 2007 0 + Microsoft InfoPath 2007 0 + Microsoft Office Communicator 2007 0 + Microsoft Office Communicator 2007 0 + Microsoft OneNote 2003 0 + Microsoft Outlook 2003 0 + Microsoft Outlook 2007 0 + Microsoft Outlook 2007 0 + Microsoft PowerPoint 2003 0 + Microsoft PowerPoint 2007 0 + Microsoft PowerPoint 2007 0 + Microsoft Project Professional 2007 0 + Microsoft Project Professional 2007 0 + Microsoft Project Standard 2007 0 + Microsoft Project Standard 2007 0 + Microsoft Publisher 2003 + Microsoft Publisher 2007 0 + Microsoft Publisher 2007 0 + Microsoft SharePoint Designer 2007 0 + Microsoft SharePoint Designer 2007 0 + Microsoft Visio Professional 2007 0 + Microsoft Visio Professional 2007 0 + Microsoft Visio Standard 2007 0 + Microsoft Visio Standard 2007 0
Not Vulnerable:

Microsoft Office Publisher Invalid Memory Reference Remote Code Execution Vulnerability

Microsoft Office Publisher is prone to a remote code-execution vulnerability.

An attacker can exploit this issue by enticing an unsuspecting victim to open a maliciously crafted Publisher file.

Successful exploits may allow attackers to execute arbitrary code with privileges of the user running the application. This may facilitate a compromise of vulnerable computers.

Microsoft Office Publisher Invalid Memory Reference Remote Code Execution Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Microsoft Office Publisher Invalid Memory Reference Remote Code Execution Vulnerability

Solution:
Microsoft released an advisory and fixes to address this issue. Please see the references for more information.


Microsoft Publisher 2007 0

• Microsoft Security Update for Microsoft Office Publisher 2007 (KB936646)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=25D272E7-F2DD -4342-92BE-7EBC2E770B44

Microsoft Office Publisher Invalid Memory Reference Remote Code Execution Vulnerability

References:

• Microsoft Office Product Homepage (Microsoft)
  
• AD20070710 Microsoft Publisher 2007 Arbitrary Pointer Dereference (eEye Digital Security)
  
• EEYE: Microsoft Publisher 2007 Arbitrary Pointer Dereference (eEye Advisories)
  
• EEYEB-20070216 (eEye Research)
  
• Microsoft Security Bulletin MS07-037 - Vulnerability in Microsoft Office Publish (Microsoft)