Microsoft Visio Version Number Remote Code Execution Vulnerability

Bugtraq ID:	24349
Class:	Input Validation Error
CVE:	CVE-2007-0934
Remote:	Yes
Local:	No
Published:	Jun 12 2007 12:00AM
Updated:	Jun 12 2007 09:29PM
Credit:	The vendor disclosed this issue.
Vulnerable:	Microsoft Visio 2003 SP2 Microsoft Visio 2003 SP1 Microsoft Visio 2003 Microsoft Visio 2002 SP2 Microsoft Visio 2002 SP1 Microsoft Visio 2002
Not Vulnerable:	Microsoft Visio Standard 2007 0 Microsoft Visio Professional 2007 0

Microsoft Visio Version Number Remote Code Execution Vulnerability

Microsoft Visio is prone to a remote code-execution vulnerability because it fails to adequately validate user-supplied data.

Attackers can exploit this issue to execute arbitrary code in the context of the user running the application. Failed attempts will result in denial-of-service conditions.

Microsoft Visio Version Number Remote Code Execution Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

Microsoft Visio Version Number Remote Code Execution Vulnerability

Solution:
Microsoft has released advisory MS07-030 as well as fixes to address this issue. Please see the references for more information.


Microsoft Visio 2002

• Microsoft Security Update for Visio 2002 (KB931280)
  http://www.microsoft.com/downloads/details/aspx?FamilyId=FC1D0483-27E8 -4541-B81D-4A47973BEA30

Microsoft Visio 2002 SP1

• Microsoft Security Update for Visio 2002 (KB931280)
  http://www.microsoft.com/downloads/details/aspx?FamilyId=FC1D0483-27E8 -4541-B81D-4A47973BEA30

Microsoft Visio 2003

• Microsoft Security Update for Visio 2003 (KB931281)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=C47F432E-8538 -42FD-92C9-7E0F1D643E8E&displaylang=en

Microsoft Visio 2003 SP1

• Microsoft Security Update for Visio 2003 (KB931281)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=C47F432E-8538 -42FD-92C9-7E0F1D643E8E&displaylang=en

Microsoft Visio 2002 SP2

• Microsoft Security Update for Visio 2002 (KB931280)
  http://www.microsoft.com/downloads/details/aspx?FamilyId=FC1D0483-27E8 -4541-B81D-4A47973BEA30

Microsoft Visio 2003 SP2

• Microsoft Security Update for Visio 2003 (KB931281)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=C47F432E-8538 -42FD-92C9-7E0F1D643E8E&displaylang=en

Microsoft Visio Version Number Remote Code Execution Vulnerability

References:

• Visio Homepage (Microsoft)
  
• Microsoft Security Bulletin MS07-030 (Microsoft)