Microsoft JET VBA Shell Vulnerability
BID:548
Info
Microsoft JET VBA Shell Vulnerability
| Bugtraq ID: | 548 |
| Class: | Input Validation Error |
| CVE: |
CVE-2000-0325 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 29 1999 12:00AM |
| Updated: | Jul 11 2009 12:56AM |
| Credit: | This vulnerability was discovered and posted to NTBugtraq by Juan Carlos Garcia Cuartango <[email protected]>. |
| Vulnerable: |
Microsoft JET 4.0 Microsoft JET 3.51 Microsoft JET 3.5 |
| Not Vulnerable: |
Microsoft JET 4.0 SP1 Microsoft JET 3.51 SP3 |
Discussion
Microsoft JET VBA Shell Vulnerability
A vulnerability affects Microsoft's Jet 3.51 and 4.0 driver (MSJET35.DLL and MSJET40.DLL).
This vulnerability could allow an attacker to create malicious '.xls' or '.doc' files incorporating VBA shell commands. When the file is opened, the shell commands contained in the file will execute on the target system. Command execution will occur in the context of the user that is opening the file.
The file could be distributed via email, the web (including in hidden frames), or any number of methods.
A vulnerability affects Microsoft's Jet 3.51 and 4.0 driver (MSJET35.DLL and MSJET40.DLL).
This vulnerability could allow an attacker to create malicious '.xls' or '.doc' files incorporating VBA shell commands. When the file is opened, the shell commands contained in the file will execute on the target system. Command execution will occur in the context of the user that is opening the file.
The file could be distributed via email, the web (including in hidden frames), or any number of methods.
Exploit / POC
Microsoft JET VBA Shell Vulnerability
This exploit by BrootForce <[email protected]> is a modified version of Juan Cuartango's original demonstration exploit.
This exploit by BrootForce <[email protected]> is a modified version of Juan Cuartango's original demonstration exploit.
Solution / Fix
Microsoft JET VBA Shell Vulnerability
Solution:
Microsoft has made a patch available at the following url:
http://officeupdate.microsoft.com/articles/mdac_typ.htm
This was made public in a Microsoft Security Advisory published on August 20, 1999. The patch works by creating a "sandbox mode" for Jet 3.5x, and changing the implementation of sandbox mode in Jet 4.0.
An additional patch made available by Microsoft, exists at the following location:
http://office.microsoft.com/assistance/9798/mdac_typ.aspx
Also, Wanderley J. Abreu Jr. <[email protected]> has written a program that will search the registry and modify the EditFlags value for DocObjects file types, setting the Confirm Open After Download value to 01. this means that these filetypes can no longer be silently downloaded and opened. This can be downloaded from:
http://www.securityfocus.com/data/vulnerabilities/patches/RegFix.zip
Solution:
Microsoft has made a patch available at the following url:
http://officeupdate.microsoft.com/articles/mdac_typ.htm
This was made public in a Microsoft Security Advisory published on August 20, 1999. The patch works by creating a "sandbox mode" for Jet 3.5x, and changing the implementation of sandbox mode in Jet 4.0.
An additional patch made available by Microsoft, exists at the following location:
http://office.microsoft.com/assistance/9798/mdac_typ.aspx
Also, Wanderley J. Abreu Jr. <[email protected]> has written a program that will search the registry and modify the EditFlags value for DocObjects file types, setting the Confirm Open After Download value to 01. this means that these filetypes can no longer be silently downloaded and opened. This can be downloaded from:
http://www.securityfocus.com/data/vulnerabilities/patches/RegFix.zip
References
Microsoft JET VBA Shell Vulnerability
References:
References:
- Frequently Asked Questions: Microsoft Security Bulletin (MS99-030) (Microsoft)
- Jet 4.0 Expression Can Execute Unsafe Visual Basic for Application Functions (Microsoft)
- Jet Expression Can Execute Unsafe Visual Basic for Application Functions (Microsoft)
- OFF: Patch Available That Eliminates Security Vulnerabilities in the Microsoft J (Microsoft)