Excel Viewer OCX ActiveX 'open()' Buffer Overflow Vulnerability

Bugtraq ID:	33322
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 16 2009 12:00AM
Updated:	Jan 19 2009 02:12PM
Credit:	ALpHaNiX
Vulnerable:	Office OCX Excel Viewer OCX 3.2 Office OCX Excel Viewer OCX 3.1
Not Vulnerable:

Excel Viewer OCX ActiveX 'open()' Buffer Overflow Vulnerability

Excel Viewer OCX is prone to a buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it into an insufficiently sized memory buffer.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in denial-of-service conditions.

Excel Viewer OCX 3.1 and 3.2 are vulnerable; other versions may also be affected.

Excel Viewer OCX ActiveX 'open()' Buffer Overflow Vulnerability

An attacker may exploit this issue by enticing a victim into visiting a malicious webpage.

The following exploit is available:

• /data/vulnerabilities/exploits/33322.html

Excel Viewer OCX ActiveX 'open()' Buffer Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Excel Viewer OCX ActiveX 'open()' Buffer Overflow Vulnerability

References:

• Excel Viewer OCX Homepage (Office OCX)
  
• Microsoft Knowledge Base Article 240797 (Microsoft)