Vulnerability Note VU#673051
Microsoft Windows opens OLE2 documents using a program specified internally by the document
Microsoft Windows may allow remote code execution through specially crafted OLE2 documents.
Microsoft object linking and embedding (OLE) is a technology that allows applications to create and edit compound documents. Compound documents can contain embedded documents or links to documents with different formats. Microsoft Word and Excel are examples of programs that use OLE compound documents. OLE2 is version 2 of the OLE architecture.
If an OLE2 document has an unrecognized file extension, the Windows Shell/Windows Explorer may determine which application should be used to open it by inspecting the class identifier (ClassID) within the document. This design may cause unpredictable and potentially damaging behavior if an attacker crafts an OLE2 document with a ClassID that references an arbitrary application.
By persuading a user to view a specially crafted OLE2 document, an attacker could execute arbitrary code with the privileges of the user.
Apple a patch
Disable HTML Application Host
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Microsoft Corporation||Affected||-||12 Apr 2005|
CVSS Metrics (Learn More)
Thanks to iDEFENSE and Microsoft Security for reporting this vulnerability.
This document was written by Ken MacInnis and Jeff Gennari.
- CVE IDs: CAN-2005-0063
- Date Public: 12 Apr 2005
- Date First Published: 12 Apr 2005
- Date Last Updated: 15 Sep 2005
- Severity Metric: 6.08
- Document Revision: 48
If you have feedback, comments, or additional information about this vulnerability, please send us email.