Microsoft OLE Automation SubstringData Function Integer Overflow Vulnerability

Bugtraq ID:	25282
Class:	Boundary Condition Error
CVE:	CVE-2007-2224
Remote:	Yes
Local:	No
Published:	Aug 14 2007 12:00AM
Updated:	Sep 04 2007 07:21PM
Credit:	An anonymous researcher working with Tipping Point and iDefense reported this issue.
Vulnerable:	Microsoft Windows XP Tablet PC Edition SP2 Microsoft Windows XP Tablet PC Edition SP1 Microsoft Windows XP Tablet PC Edition Microsoft Windows XP Professional x64 Edition SP2 Microsoft Windows XP Professional x64 Edition Microsoft Windows XP Professional SP2 Microsoft Windows XP Professional SP1 Microsoft Windows XP Professional Microsoft Windows XP Media Center Edition SP2 Microsoft Windows XP Media Center Edition SP1 Microsoft Windows XP Media Center Edition Microsoft Windows XP Home SP2 Microsoft Windows XP Home SP1 Microsoft Windows XP Home Microsoft Windows Server 2003 Web Edition SP2 Microsoft Windows Server 2003 Web Edition SP1 Microsoft Windows Server 2003 Standard x64 Edition Microsoft Windows Server 2003 Standard Edition SP2 Microsoft Windows Server 2003 Standard Edition SP1 Microsoft Windows Server 2003 Itanium SP2 Microsoft Windows Server 2003 Itanium SP1 Microsoft Windows Server 2003 Enterprise x64 Edition SP2 Microsoft Windows Server 2003 Enterprise x64 Edition Microsoft Windows Server 2003 Datacenter x64 Edition SP2 Microsoft Windows Server 2003 Datacenter x64 Edition Microsoft Windows Server 2003 Datacenter Edition Itanium SP1 Microsoft Windows Server 2003 Datacenter Edition Itanium 0 Microsoft Windows Server 2003 Datacenter Edition SP1 Microsoft Windows Server 2003 SP2 Microsoft Windows Server 2003 SP1 Microsoft Windows 2000 Terminal Services SP4 + Microsoft Windows 2000 Advanced Server SP4 + Microsoft Windows 2000 Datacenter Server SP4 + Microsoft Windows 2000 Server SP4 Microsoft Windows 2000 Terminal Services SP3 + Microsoft Windows 2000 Advanced Server SP3 + Microsoft Windows 2000 Datacenter Server SP3 + Microsoft Windows 2000 Server SP3 Microsoft Windows 2000 Terminal Services SP2 + Microsoft Windows 2000 Advanced Server SP2 + Microsoft Windows 2000 Datacenter Server SP2 + Microsoft Windows 2000 Server SP2 Microsoft Windows 2000 Terminal Services SP1 + Microsoft Windows 2000 Advanced Server SP1 + Microsoft Windows 2000 Datacenter Server SP1 + Microsoft Windows 2000 Server SP1 Microsoft Windows 2000 Terminal Services + Microsoft Windows 2000 Advanced Server + Microsoft Windows 2000 Datacenter Server + Microsoft Windows 2000 Server Microsoft Windows 2000 Server SP4 Microsoft Windows 2000 Server SP3 Microsoft Windows 2000 Server SP2 Microsoft Windows 2000 Server SP1 Microsoft Windows 2000 Professional SP4 Microsoft Windows 2000 Professional SP3 Microsoft Windows 2000 Professional SP2 Microsoft Windows 2000 Professional SP1 Microsoft Windows 2000 Professional Microsoft Windows 2000 Datacenter Server SP4 Microsoft Windows 2000 Datacenter Server SP3 Microsoft Windows 2000 Datacenter Server SP2 Microsoft Windows 2000 Datacenter Server SP1 Microsoft Windows 2000 Datacenter Server Microsoft Windows 2000 Advanced Server SP4 Microsoft Windows 2000 Advanced Server SP3 Microsoft Windows 2000 Advanced Server SP2 Microsoft Windows 2000 Advanced Server SP1 Microsoft Windows 2000 Advanced Server Microsoft Visual Basic 6.0 SP6 Microsoft Office 2004 for Mac 0 HP Storage Management Appliance III HP Storage Management Appliance II HP Storage Management Appliance I HP Storage Management Appliance 2.1 + HP Storage Management Appliance III + HP Storage Management Appliance II + HP Storage Management Appliance I HP Storage Management Appliance 2.1 + HP Storage Management Appliance III + HP Storage Management Appliance II + HP Storage Management Appliance I Avaya Messaging Application Server MM 3.1 Avaya Messaging Application Server MM 3.0 Avaya Messaging Application Server MM 2.0 Avaya CIE 1.0.2 Avaya CIE 1.0
Not Vulnerable:

Microsoft OLE Automation SubstringData Function Integer Overflow Vulnerability

Microsoft OLE Automation is prone to an integer-overflow vulnerability. this issue occurs because the application fails to ensure that integer values are not overrun.

Successfully exploiting this issue allows remote attackers to corrupt heap memory and execute arbitrary in the context of the affeced application. Failed exploit attempts will result in a denial-of-service condition.

Microsoft OLE Automation SubstringData Function Integer Overflow Vulnerability

Currently we are not aware of any working exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

Microsoft OLE Automation SubstringData Function Integer Overflow Vulnerability

Solution:
The vendor released updates and an advisory to address this issue. Please see the references for more information.


Microsoft Windows Server 2003 Datacenter Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB921503)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=15d4d4fa-9bab -4da5-978e-f89c78c8086a

Microsoft Windows XP Media Center Edition SP2

• Microsoft Security Update for Windows XP (KB921503)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=6e8de050-8589 -4831-ae19-075c93509485

Microsoft Windows Server 2003 Itanium SP1

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB921503)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=fc04451a-0696 -4a21-b2b6-f02d4e2c33bf&displaylang=en

Microsoft Office 2004 for Mac 0

• Microsoft Microsoft Office 2004 for Mac 11.3.7 Update
  http://download.microsoft.com/download/E/9/B/E9B2A7C6-438A-4CF9-BB35-9 01C01F3C996/Office2004-1137UpdateEN.dmg

Microsoft Windows Server 2003 Datacenter x64 Edition SP2

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB921503)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=6608d722-3ef8 -4085-b771-7b17bb0ba06e

Microsoft Windows XP Tablet PC Edition SP2

• Microsoft Security Update for Windows XP (KB921503)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=6e8de050-8589 -4831-ae19-075c93509485

Microsoft Windows Server 2003 Web Edition SP2

• Microsoft Security Update for Windows Server 2003 (KB921503)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=15d4d4fa-9bab -4da5-978e-f89c78c8086a

Microsoft Windows Server 2003 Standard Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB921503)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=15d4d4fa-9bab -4da5-978e-f89c78c8086a

Microsoft Windows Server 2003 Enterprise x64 Edition

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB921503)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=6608d722-3ef8 -4085-b771-7b17bb0ba06e

Microsoft Windows Server 2003 Datacenter Edition Itanium 0

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB921503)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=fc04451a-0696 -4a21-b2b6-f02d4e2c33bf&displaylang=en

Microsoft Windows Server 2003 Datacenter x64 Edition

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB921503)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=6608d722-3ef8 -4085-b771-7b17bb0ba06e

Microsoft Windows 2000 Advanced Server SP4

• Microsoft Security Update for Windows 2000 (KB921503)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=5c35b6e8-732a -4451-b5d4-23ed63e6e792&displaylang=en

Microsoft Windows Server 2003 SP2

• Microsoft Security Update for Windows Server 2003 (KB921503)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=15d4d4fa-9bab -4da5-978e-f89c78c8086a

Microsoft Windows Server 2003 Standard Edition SP2

• Microsoft Security Update for Windows Server 2003 (KB921503)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=15d4d4fa-9bab -4da5-978e-f89c78c8086a

Microsoft Windows XP Home SP2

• Microsoft Security Update for Windows XP (KB921503)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=6e8de050-8589 -4831-ae19-075c93509485

Microsoft Windows Server 2003 SP1

• Microsoft Security Update for Windows Server 2003 (KB921503)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=15d4d4fa-9bab -4da5-978e-f89c78c8086a

Microsoft Windows 2000 Datacenter Server SP4

• Microsoft Security Update for Windows 2000 (KB921503)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=5c35b6e8-732a -4451-b5d4-23ed63e6e792&displaylang=en

Microsoft Windows Server 2003 Itanium SP2

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB921503)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=fc04451a-0696 -4a21-b2b6-f02d4e2c33bf&displaylang=en

Microsoft Visual Basic 6.0 SP6

• Microsoft Visual Basic 6 OLEAUT32.DLL Security Update
  http://www.microsoft.com/downloads/details.aspx?FamilyId=E1646FB0-29D5 -4A6E-A8D2-304C4D7735B7&displaylang=en

Microsoft Windows Server 2003 Web Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB921503)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=15d4d4fa-9bab -4da5-978e-f89c78c8086a

Microsoft Windows Server 2003 Datacenter Edition Itanium SP1

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB921503)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=fc04451a-0696 -4a21-b2b6-f02d4e2c33bf&displaylang=en

Microsoft Windows XP Professional SP2

• Microsoft Security Update for Windows XP (KB921503)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=6e8de050-8589 -4831-ae19-075c93509485

Microsoft Windows Server 2003 Standard x64 Edition

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB921503)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=6608d722-3ef8 -4085-b771-7b17bb0ba06e

Microsoft Windows 2000 Server SP4

• Microsoft Security Update for Windows 2000 (KB921503)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=5c35b6e8-732a -4451-b5d4-23ed63e6e792&displaylang=en

Microsoft Windows 2000 Professional SP4

• Microsoft Security Update for Windows 2000 (KB921503)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=5c35b6e8-732a -4451-b5d4-23ed63e6e792&displaylang=en

Microsoft OLE Automation SubstringData Function Integer Overflow Vulnerability

References:

• Microsoft Homepage (Microsoft)
  
• ZDI-07-048: Microsoft Internet Explorer substringData Heap Overflow Vulnerabilit ([email protected])
  
• ASA-2007-367 MS07-043 Vulnerability in OLE Automation Could Allow Remote Code Ex (Avaya)
  
• Microsoft Internet Explorer substringData() Heap Overflow Vulnerability (Zero Day Initiative)
  
• Microsoft Security Bulletin MS07-043 - Vulnerability in OLE Automation (Microsoft)