search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Microsoft PowerPoint malformed record vulnerability

Vulnerability Note VU#190089

Original Release Date: 2006-06-13 | Last Revised: 2006-06-15

Overview

Microsoft PowerPoint fails to properly handle malformed records. This may allow a remote attacker to execute arbitrary code on a vulnerable system.

Description

Microsoft PowerPoint

Microsoft PowerPoint is presentation software that is available on Microsoft Windows and Apple Mac platforms.

PowerPoint documents

A PowerPoint document is made up of a tree of records. These records can contain data or other records.

The problem

Microsoft PowerPoint fails to properly handle malformed records.

Impact

By convincing a user to open a PowerPoint document, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system with the privileges of the user.

Solution

Apply an update

This issue is addressed in Microsoft Security Bulletin MS06-028. Note that Windows and Mac versions of PowerPoint are affected.


Do not open PowerPoint documents from untrusted sources

By only accessing PowerPoint documents from trusted or known sources, the chances of exploitation are reduced.

Vendor Information

190089
 
Affected   Unknown   Unaffected

Microsoft Corporation

Updated:  June 13, 2006

Status

  Vulnerable

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see Microsoft Security Bulletin MS06-028.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A

References

Acknowledgements

Thanks to Microsoft Security for reporting this vulnerability.

This document was written by Will Dormann.

Other Information

CVE IDs: CVE-2006-0022
Severity Metric: 13.67
Date Public: 2006-06-13
Date First Published: 2006-06-13
Date Last Updated: 2006-06-15 20:11 UTC
Document Revision: 3

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.