search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Microsoft Object Packager fails to properly display file types

Vulnerability Note VU#703936

Original Release Date: 2006-10-10 | Last Revised: 2006-10-10


The Microsoft Object Packager fails to properly display the file types. This vulnerability may allow a remote, unauthenticated attacker execute arbitrary code on a vulnerable system.


According to Microsoft:

Object Packager is a tool you can use to create a package that you can insert into a file.
The Object Packager fails to properly display the file types of embedded objects. According to Microsoft Security Bulletin MS06-065:

An attacker could try to exploit the vulnerability by creating a specially crafted file and sending the file to a user on an affected system in email or by having them click on a link to receive the file. Once the file is received the user would then have to click on the embedded object within the file and accept a misleading dialogue indicating that the user is about access a different file type.
More information is available in Microsoft Security Bulletin MS06-065.


Attackers can conceal the types of objects embedded within files, possibly misleading users into executing arbitrary code.


Apply an update
This vulnerability is addressed in Microsoft Security Bulletin MS06-065.

Do not open files from untrusted sources

Do not open files originating from unfamiliar or unexpected sources, including those received as email attachments or hosted on a web site. For more information, please see Using Caution with Email Attachments.

Vendor Information


Microsoft Corporation Affected

Notified:  October 10, 2006 Updated: October 10, 2006



Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.


Refer to

If you have feedback, comments, or additional information about this vulnerability, please send us email.

CVSS Metrics

Group Score Vector



This issue was reported in Microsoft Security Bulletin MS06-065. Microsoft credits Andreas Sandblad of Secunia Research for reporting this vulnerability.

This document was written by Jeff Gennari.

Other Information

CVE IDs: CVE-2006-4692
Severity Metric: 9.90
Date Public: 2006-10-10
Date First Published: 2006-10-10
Date Last Updated: 2006-10-10 20:21 UTC
Document Revision: 18

Sponsored by CISA.