search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Microsoft Windows fails to properly handle malformed OLE documents

Vulnerability Note VU#194944

Original Release Date: 2007-03-07 | Last Revised: 2007-03-12

Overview

A vulnerability exists in a Microsoft Windows library that is used to handle OLE documents. The complete impact of this vulnerability is not clear, but may include the execution of arbitrary code as well as a denial of service.

Description

Microsoft OLE documents include summary information about the document, such as the line count. A memory corruption vulnerability exists in a library (ole32.dll) used by Windows to parse OLE document summary information. Note that Microsoft Windows can parse OLE document summary information without having Microsoft Office installed.

Public exploit code targeting Microsoft Windows Explorer is available for this vulnerability. The public exploit code uses specially crafted Office document to trigger the vulnerability in Microsoft Windows Explorer. However, any application that links to ole32.dll may also be affected.

Impact

The complete impact of this vulnerability is not known. Memory corruption does occur, but it is not clear if this can be leveraged to execute arbitrary code. At a minimum, this vulnerability will cause a denial of service.

Solution

We are currently unaware of a practical solution to this problem. Until a solution is available, the following workarounds may reduce the chances of exploitation:

Do not access untrusted Office documents

This vulnerability can be triggered by accessing a specially crafted Office document, or by accessing the folder containing that document. Do not access unfamiliar or unexpected Office documents, particularly those hosted on web sites or delivered as email attachments. Please see Cyber Security Tip ST04-010 for more information.


Do not rely on file name extension filtering

In most cases, Windows will call Office to open a document even if the document has an unknown file extension. For example, if document.qwer contains the correct file header information, Windows will open document.qwer with the appropriate Office application. Filtering for common extensions (e.g., .doc, .xls, and .ppt) will not detect all Office documents.

Vendor Information

194944
 
Affected   Unknown   Unaffected

Microsoft Corporation

Updated:  March 07, 2007

Status

  Vulnerable

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.


CVSS Metrics

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A

References

Credit

This vulnerability was publicly disclosed by Marsu.

This document was written by Jeff Gennari.

Other Information

CVE IDs: None
Severity Metric: 22.05
Date Public: 2007-03-07
Date First Published: 2007-03-07
Date Last Updated: 2007-03-12 13:53 UTC
Document Revision: 20

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.