Multiple Office OCX ActiveX Controls 'Save()' Arbitrary File Overwrite Vulnerability

Bugtraq ID:	33238
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 13 2009 12:00AM
Updated:	Jan 13 2009 06:22PM
Credit:	Stack and Houssamix
Vulnerable:	Office OCX Word Viewer OCX 3.2 Office OCX PowerPoint Viewer OCX 3.1 Office OCX Office Viewer OCX 3.2
Not Vulnerable:

Multiple Office OCX ActiveX Controls 'Save()' Arbitrary File Overwrite Vulnerability

Multiple Office OCX ActiveX controls are prone to a vulnerability that lets attackers overwrite arbitrary files.

Successful exploits may result in denial-of-service conditions. Other attacks are also possible.

The following ActiveX controls are vulnerable:

Office Viewer OCX 3.0.1
Word Viewer OCX 3.2
PowerPoint Viewer OCX 3.1

Multiple Office OCX ActiveX Controls 'Save()' Arbitrary File Overwrite Vulnerability

To exploit this issue, an attacker must entice an unsuspecting victim into viewing a malicious web page.

The following example exploit code is available:

• /data/vulnerabilities/exploits/33238_powerpoint.html
• /data/vulnerabilities/exploits/33238_office.html
• /data/vulnerabilities/exploits/33238_word.html

Multiple Office OCX ActiveX Controls 'Save()' Arbitrary File Overwrite Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Multiple Office OCX ActiveX Controls 'Save()' Arbitrary File Overwrite Vulnerability

References:

• Microsoft Knowledge Base Article 240797 (Microsoft)
  
• Office Viewer (Office OCX)
  
• PowerPoint Viewer (Office OCX)
  
• Word Viewer (Office OCX)