Microsoft Office Web Components Clipboard Information Disclosure Vulnerability

Bugtraq ID:	4457
Class:	Design Error
CVE:	CVE-2002-0861
Remote:	Yes
Local:	No
Published:	Apr 08 2002 12:00AM
Updated:	Jul 11 2009 11:56AM
Credit:	Discovered by GreyMagic Software <[email protected]>.
Vulnerable:	Microsoft Project 2002 Microsoft Project 2000 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 Microsoft Office Web Components 2002 + Microsoft BizTalk Server 2002 Developer Edition + Microsoft BizTalk Server 2002 Enterprise Edition + Microsoft Commerce Server 2002 + Microsoft Money 2002 + Microsoft Money 2003 + Microsoft Office XP + Microsoft Project 2002 + Microsoft Project Server 2002 Microsoft Office Web Components 2000 0 + Microsoft Back Office Server 2000 + Microsoft Back Office Server 2000 + Microsoft BizTalk Server 2000 Developer Edition SP2 + Microsoft BizTalk Server 2000 Developer Edition SP2 + Microsoft BizTalk Server 2000 Developer Edition SP1a + Microsoft BizTalk Server 2000 Developer Edition SP1a + Microsoft BizTalk Server 2000 Developer Edition + Microsoft BizTalk Server 2000 Developer Edition + Microsoft BizTalk Server 2000 Enterprise Edition SP2 + Microsoft BizTalk Server 2000 Enterprise Edition SP2 + Microsoft BizTalk Server 2000 Enterprise Edition SP1a + Microsoft BizTalk Server 2000 Enterprise Edition SP1a + Microsoft BizTalk Server 2000 Enterprise Edition + Microsoft BizTalk Server 2000 Enterprise Edition + Microsoft BizTalk Server 2000 Standard Edition SP2 + Microsoft BizTalk Server 2000 Standard Edition SP2 + Microsoft BizTalk Server 2000 Standard Edition SP1a + Microsoft BizTalk Server 2000 Standard Edition SP1a + Microsoft BizTalk Server 2000 Standard Edition + Microsoft BizTalk Server 2000 Standard Edition + Microsoft BizTalk Server 2002 Developer Edition + Microsoft BizTalk Server 2002 Enterprise Edition + Microsoft Commerce Server 2000 SP2 + Microsoft Commerce Server 2000 SP2 + Microsoft Commerce Server 2000 SP1 + Microsoft Commerce Server 2000 SP1 + Microsoft Commerce Server 2000 + Microsoft Commerce Server 2000 + Microsoft Commerce Server 2002 + Microsoft Internet Explorer for Unix SP2 + Microsoft ISA Server 2000 SP2 + Microsoft ISA Server 2000 SP1 + Microsoft ISA Server 2000 SP1 + Microsoft ISA Server 2000 FP1 + Microsoft ISA Server 2000 + Microsoft ISA Server 2000 + Microsoft ISA Server 2000 Enterprise Edition SP2 + Microsoft ISA Server 2000 Enterprise Edition SP1 + Microsoft ISA Server 2000 Enterprise Edition + Microsoft Office 2000 SP2 + Microsoft Office 2000 SP2 + Microsoft Office 2000 SP1 + Microsoft Office 2000 SP1 + Microsoft Office 2000 + Microsoft Office 2000 + Microsoft Office XP SP3 + Microsoft Office XP SP2 + Microsoft Office XP SP1 + Microsoft Office XP + Microsoft Small Business Server 2000 0 + Microsoft Visual Studio .NET 2002 + Microsoft Visual Studio .NET 2003 Enterprise Architect + Microsoft Visual Studio .NET Enterprise Architect Edition + Microsoft Visual Studio .NET Enterprise Developer Edition
Not Vulnerable:

Microsoft Office Web Components Clipboard Information Disclosure Vulnerability

Microsoft Office Web Components (OWC) are a collection of ActiveX objects which provide limited Office functionality to web pages. OWC is installed by default with both Office 2000 and Office XP.

A vulnerability has been reported within some versions of the OWC Spreadsheet component. It is possible for a web page using this component to gain control of the clipboard operations, even when the 'Allow paste operations via script' security feature in IE is disabled.

Microsoft Office Web Components Clipboard Information Disclosure Vulnerability

An exploit is provided in the GreyMagic advisory listed in the references section of this document.

Microsoft Office Web Components Clipboard Information Disclosure Vulnerability

Solution:
Fixes are available:


Microsoft Office Web Components 2002

• Microsoft Q322382
  http://support.microsoft.com/default.aspx?scid=kb;%5bLN%5d;Q322382


• Microsoft Office Web Components Upgrade
  At the time of this writing, this link was not active.
  http://office.microsoft.com/downloads/2002/owc10.aspx

Microsoft Project 2002

• Microsoft prj1001.aspx
  http://office.microsoft.com/downloads/2002/prj1001.aspx

Microsoft Office Web Components Clipboard Information Disclosure Vulnerability

References:

• Microsoft Security Bulletin MS02-044 (Microsoft)