Microsoft Office XP Spreadsheet Host().SaveAs() File Creation Vulnerability

Bugtraq ID:	4398
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Mar 31 2002 12:00AM
Updated:	Mar 31 2002 12:00AM
Credit:	Posted to BugTraq on March 31, 2002 by Georgi Guninski.
Vulnerable:	Microsoft Office XP - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional
Not Vulnerable:

Microsoft Office XP Spreadsheet Host().SaveAs() File Creation Vulnerability

Microsoft Office XP provides a spreadsheet component that can be embedded in web pages and office documents. This spreadsheet component contains a bug in a function called HOST() that can be exploited to write arbitrary files. This can be done from office documents, and possibly other vectors such as HTML mail.

This is accomplished by embedding a spreadsheet object containing a formula similar to the following: =Host().SaveAs("arbitraryfilename")

Microsoft has released patches which address a related vulnerability (BugTraq ID 4397 "Microsoft Outlook HTML Mail Script Execution Vulnerability"). However, it has been reported that these patches do not address this issue in the Excel component of Office XP.

Microsoft Office XP Spreadsheet Host().SaveAs() File Creation Vulnerability

See the BugTraq post by Georgi Guninski for a sample exploit.

Microsoft Office XP Spreadsheet Host().SaveAs() File Creation Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Microsoft Office XP Spreadsheet Host().SaveAs() File Creation Vulnerability

References:

• More Office XP problems (Georgi Guninski )