Vulnerability Note VU#703936

Microsoft Object Packager fails to properly display file types

Object Packager is a tool you can use to create a package that you can insert into a file.

An attacker could try to exploit the vulnerability by creating a specially crafted file and sending the file to a user on an affected system in email or by having them click on a link to receive the file. Once the file is received the user would then have to click on the embedded object within the file and accept a misleading dialogue indicating that the user is about access a different file type.

This vulnerability is addressed in Microsoft Security Bulletin MS06-065.

Do not open files from untrusted sources

Do not open files originating from unfamiliar or unexpected sources, including those received as email attachments or hosted on a web site. For more information, please see Using Caution with Email Attachments.

Systems Affected

http://www.microsoft.com/technet/security/bulletin/ms06-065.mspx
http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/packager_what_is_obj_pkg.mspx?mfr=true

Credit

This issue was reported in Microsoft Security Bulletin MS06-065. Microsoft credits Andreas Sandblad of Secunia Research for reporting this vulnerability.

This document was written by Jeff Gennari.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.