Microsoft East Asian Word Conversion Vulnerability

Bugtraq ID:	946
Class:	Boundary Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	Jan 20 2000 12:00AM
Updated:	Jan 20 2000 12:00AM
Credit:	Publicized in Microsoft Security Bulletin MS00-002 released on January 20, 2000.
Vulnerable:	Microsoft Word 98 Korean Version Microsoft Word 98 Japanese Version Microsoft Word 98 Chinese Version Microsoft Word 97 Korean Version Microsoft Word 97 Japanese Version Microsoft Word 97 Chinese Version Microsoft Word 2000 Korean Version Microsoft Word 2000 Japanese Version Microsoft Word 2000 Chinese Version Microsoft PowerPoint 97 Korean Edition Microsoft PowerPoint 97 Japanese Edition Microsoft PowerPoint 97 Chinese Edition Microsoft PowerPoint 2000 Korean Edition Microsoft PowerPoint 2000 Japanese Edition Microsoft PowerPoint 2000 Chinese Edition Microsoft Office 97 Korean Version Microsoft Office 97 Japanese Version Microsoft Office 97 Chinese Version Microsoft Office 2000 Korean Version Microsoft Office 2000 Japanese Version Microsoft Office 2000 Chinese Version Microsoft Converter Pack 2000 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0
Not Vulnerable:

Microsoft East Asian Word Conversion Vulnerability

East Asian language versions of Word and Powerpoint are susceptible to a buffer overflow exploit. The overflowable buffer is in the code that converts Word 5 documents into newer formats. Word 97, 98, and 2000 will automatically convert older files into the new format upon loading.

If a specially-modified Chinese, Japanese or Korean Word 5 document is loaded into a newer version of Word or PowerPoint, arbitrary code can be executed during the conversion process, at the privilege level of the current user.

Microsoft East Asian Word Conversion Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Microsoft East Asian Word Conversion Vulnerability

Solution:
Microsoft has released patches for this issue, available at:

- Word 97 or 98, PowerPoint 98: -
US:
http://officeupdate.microsoft.com/downloaddetails/ww5pkg.htm
Japan:
http://officeupdate.microsoft.com/japan/downloaddetails/MalformedData-97.htm
Korea:
http://officeupdate.microsoft.com/korea/downloaddetails/MalformedData-97.htm
China:
http://officeupdate.microsoft.com/china/downloaddetails/MalformedData-97.htm
Taiwan:
http://officeupdate.microsoft.com/taiwan/downloaddetails/MalformedData-97.htm
Hong Kong:
http://officeupdate.microsoft.com/hk/downloaddetails/MalformedData-97.htm

- Converter Pack 2000; Office 2000 with Multilanguage Pack; Word 2000, PowerPoint 2000: -
US:
http://officeupdate.microsoft.com/2000/downloaddetails/ww5pkg.htm
Japan:
http://officeupdate.microsoft.com/japan/downloaddetails/2000/MalformedData-2K.htm
Korea:
http://officeupdate.microsoft.com/korea/downloaddetails/2000/MalformedData-2K.htm
China:
http://officeupdate.microsoft.com/china/downloaddetails/2000/MalformedData-2K.htm
Taiwan:
http://officeupdate.microsoft.com/taiwan/downloaddetails/2000/MalformedData-2K.htm
Hong Kong:
http://officeupdate.microsoft.com/hk/downloaddetails/2000/MalformedData-2K.htm

Microsoft East Asian Word Conversion Vulnerability

References:

• Frequently Asked Questions: Microsoft Security Bulletin MS00-002 (Microsoft)
  
• Q249881: Patch Available for "Malformed Conversion Data" Vulnerability (East Asi (Microsoft)