search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Microsoft Object Packager fails to properly display file types

Vulnerability Note VU#703936

Original Release Date: 2006-10-10 | Last Revised: 2006-10-10

Overview

The Microsoft Object Packager fails to properly display the file types. This vulnerability may allow a remote, unauthenticated attacker execute arbitrary code on a vulnerable system.

Description

According to Microsoft:

Object Packager is a tool you can use to create a package that you can insert into a file.
The Object Packager fails to properly display the file types of embedded objects. According to Microsoft Security Bulletin MS06-065:

An attacker could try to exploit the vulnerability by creating a specially crafted file and sending the file to a user on an affected system in email or by having them click on a link to receive the file. Once the file is received the user would then have to click on the embedded object within the file and accept a misleading dialogue indicating that the user is about access a different file type.
More information is available in Microsoft Security Bulletin MS06-065.

Impact

Attackers can conceal the types of objects embedded within files, possibly misleading users into executing arbitrary code.

Solution

Apply an update
This vulnerability is addressed in Microsoft Security Bulletin MS06-065.

Do not open files from untrusted sources

Do not open files originating from unfamiliar or unexpected sources, including those received as email attachments or hosted on a web site. For more information, please see Using Caution with Email Attachments.

Vendor Information

703936
 
Affected   Unknown   Unaffected

Microsoft Corporation

Notified:  October 10, 2006 Updated:  October 10, 2006

Status

  Vulnerable

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Refer to http://www.microsoft.com/technet/security/bulletin/ms06-065.mspx.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A

References

Acknowledgements

This issue was reported in Microsoft Security Bulletin MS06-065 . Microsoft credits Andreas Sandblad of Secunia Research f or reporting this vulnerability.

This document was written by Jeff Gennari.

Other Information

CVE IDs: CVE-2006-4692
Severity Metric: 9.90
Date Public: 2006-10-10
Date First Published: 2006-10-10
Date Last Updated: 2006-10-10 20:21 UTC
Document Revision: 18

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.