Microsoft Office Web Component Memory Access Violation Denial of Service Vulnerability

Bugtraq ID:	26405
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Nov 12 2007 12:00AM
Updated:	Nov 13 2007 09:45PM
Credit:	Elazar Broad is credited with the discovery of this issue.
Vulnerable:	Microsoft Office Web Components 2003 0 + Microsoft BizTalk Server 2002 Developer Edition + Microsoft BizTalk Server 2002 Enterprise Edition + Microsoft Commerce Server 2002 + Microsoft Money 2002 + Microsoft Money 2003 + Microsoft Office XP + Microsoft Project 2002 + Microsoft Project Server 2002
Not Vulnerable:

Microsoft Office Web Component Memory Access Violation Denial of Service Vulnerability

Microsoft Office Web Component is prone to a denial-of-service vulnerability because of a memory access violation.

Attackers can exploit this issue to crash Internet Explorer and deny service to legitimate users.

This issue affects OWC11 for Microsoft Office 2003.

Microsoft Office Web Component Memory Access Violation Denial of Service Vulnerability

To exploit this issue, an attacker must entice an unsuspecting victim to use the affected application to view a maliciously crafted webpage.

The following example exploit code is available:

• /data/vulnerabilities/exploits/26405.html

Microsoft Office Web Component Memory Access Violation Denial of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Microsoft Office Web Component Memory Access Violation Denial of Service Vulnerability

References:

• Microsoft Windows Homepage (Microsoft )
  
• Office 2003 Add-in: Office Web Components (Microsoft)