search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Microsoft Windows opens OLE2 documents using a program specified internally by the document

Vulnerability Note VU#673051

Original Release Date: 2005-04-12 | Last Revised: 2005-09-15


Microsoft Windows may allow remote code execution through specially crafted OLE2 documents.


Microsoft object linking and embedding (OLE) is a technology that allows applications to create and edit compound documents. Compound documents can contain embedded documents or links to documents with different formats. Microsoft Word and Excel are examples of programs that use OLE compound documents. OLE2 is version 2 of the OLE architecture.

If an OLE2 document has an unrecognized file extension, the Windows Shell/Windows Explorer may determine which application should be used to open it by inspecting the class identifier (ClassID) within the document. This design may cause unpredictable and potentially damaging behavior if an attacker crafts an OLE2 document with a ClassID that references an arbitrary application.

For instance, an attacker can create an OLE2 document with an unrecognized file extension, the ClassID for the HTML Application Host (MSHTA.exe) ClassID, and arbitrary scripting code. When a user opens this document, MSHTA.exe will be called to handle the document and, consequently, execute the embedded script.

A similar issue was previously addressed in Microsoft Security Bulletin MS05-008. Microsoft Security Bulletin MS05-016 replaces Bulletin MS05-008. Note that after applying MS05-016, certain ClassIDs may still be used to determine which application will handle a document.


By persuading a user to view a specially crafted OLE2 document, an attacker could execute arbitrary code with the privileges of the user.


Apple a patch
Microsoft has addressed this issue in Microsoft Security Bulletin MS05-016.

Disable HTML Application Host

Microsoft recommends disabling the HTML Application Host. While this workaround will not correct the underlying vulnerability, it will help block known attack vectors. Microsoft Security Bulletin MS05-016 contains details on how to disable this program.

Do not accept documents from untrusted sources

Exploitation occurs by accessing a specially crafted OLE2 documents. By only accessing documents from trusted or known sources, the chances of exploitation are reduced.

Vendor Information


Microsoft Corporation Affected

Updated:  April 12, 2005



Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.


Microsoft Security Bulletin MS05-016 contains details, updates, and workarounds concerning this issue.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

CVSS Metrics

Group Score Vector
Base 0 AV:--/AC:--/Au:--/C:--/I:--/A:--
Temporal 0 E:ND/RL:ND/RC:ND
Environmental 0 CDP:ND/TD:M/CR:ND/IR:ND/AR:ND



Thanks to iDEFENSE and Microsoft Security for reporting this vulnerability.

This document was written by Ken MacInnis and Jeff Gennari.

Other Information

CVE IDs: CVE-2005-0063
Severity Metric: 6.08
Date Public: 2005-04-12
Date First Published: 2005-04-12
Date Last Updated: 2005-09-15 12:52 UTC
Document Revision: 49

Sponsored by CISA.