Microsoft Office Publisher Remote Denial of Service Vulnerability

Bugtraq ID:	22724
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 26 2007 12:00AM
Updated:	Feb 26 2007 08:06PM
Credit:	Tom Ferris discovered this vulnerability.
Vulnerable:	Microsoft Publisher 2007 0 Microsoft Office 2007 0 + Microsoft Access 2007 0 + Microsoft Access 2007 0 + Microsoft Excel 2003 + Microsoft Excel 2007 0 + Microsoft Excel 2007 0 + Microsoft FrontPage 2003 + Microsoft Groove 2007 0 + Microsoft Groove 2007 0 + Microsoft InfoPath 2003 + Microsoft InfoPath 2007 0 + Microsoft InfoPath 2007 0 + Microsoft Office Communicator 2007 0 + Microsoft Office Communicator 2007 0 + Microsoft OneNote 2003 0 + Microsoft Outlook 2003 0 + Microsoft Outlook 2007 0 + Microsoft Outlook 2007 0 + Microsoft PowerPoint 2003 0 + Microsoft PowerPoint 2007 0 + Microsoft PowerPoint 2007 0 + Microsoft Project Professional 2007 0 + Microsoft Project Professional 2007 0 + Microsoft Project Standard 2007 0 + Microsoft Project Standard 2007 0 + Microsoft Publisher 2003 + Microsoft Publisher 2007 0 + Microsoft Publisher 2007 0 + Microsoft SharePoint Designer 2007 0 + Microsoft SharePoint Designer 2007 0 + Microsoft Visio Professional 2007 0 + Microsoft Visio Professional 2007 0 + Microsoft Visio Standard 2007 0 + Microsoft Visio Standard 2007 0
Not Vulnerable:

Microsoft Office Publisher Remote Denial of Service Vulnerability

Microsoft Office Publisher is prone to a remote denial-of-service vulnerability because the application fails to properly handle malformed files.

Successfully exploiting this issue allows remote attackers to crash the affected application, denying service to legitimate users.

Microsoft Office Publisher 2007 is vulnerable; other versions may also be affected.

Microsoft Office Publisher Remote Denial of Service Vulnerability

The following file demonstrates this issue:

• /data/vulnerabilities/exploits/sp-x44.pub

Microsoft Office Publisher Remote Denial of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

Microsoft Office Publisher Remote Denial of Service Vulnerability

References:

• Microsoft Office Product Homepage (Microsoft)
  
• Microsoft Office Publisher 2007 DoS (Tom Ferris)