Office Viewer OCX ActiveX Control 'Open()' Method Arbitrary Command Execution Vulnerability

Bugtraq ID:	33245
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 13 2009 12:00AM
Updated:	Jan 13 2009 08:12PM
Credit:	Houssamix
Vulnerable:	Office OCX Office Viewer OCX 3.0.1
Not Vulnerable:

Office Viewer OCX ActiveX Control 'Open()' Method Arbitrary Command Execution Vulnerability

Office OCX Office Viewer OCX ActiveX control is prone to a vulnerability that lets attackers execute arbitrary commands.

Successfully exploiting this issue allows remote attackers to execute arbitrary commands in the context of the application using the ActiveX control (typically Internet Explorer).

Office Viewer OCX 3.0.1 is vulnerable; other versions may also be affected.

Office Viewer OCX ActiveX Control 'Open()' Method Arbitrary Command Execution Vulnerability

To exploit this issue, an attacker must entice an unsuspecting user to access a malicious webpage.

The following exploit code is available:

• /data/vulnerabilities/exploits/33245.html

Office Viewer OCX ActiveX Control 'Open()' Method Arbitrary Command Execution Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Office Viewer OCX ActiveX Control 'Open()' Method Arbitrary Command Execution Vulnerability

References:

• Microsoft Knowledge Base Article 240797 (Microsoft)
  
• Office Viewer (Office OCX)