Vulnerability CVE-2005-4131

Vulnerability CVE-2005-4131

Published: 2005-12-09 Modified: 2012-02-12

Description:

Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via an Excel file with a malformed range, which could lead to memory corruption involving an argument to the msvcrt.memmove function, aka "Brand new Microsoft Excel Vulnerability," as originally placed for sale on eBay as item number 7203336538.

See advisories in our WLB2 database:

	Topic	Author	Date
High	High Risk Vulnerability in Microsoft Excel	Peter Winter-Smi...	15.03.2006
High	Microsoft Excel Named Range Arbitrary Code Execution	vuln hexview com	16.03.2006

Type:

CWE-noinfo

CVSS2 => (AV:N/AC:M/Au:N/C:P/I:P/A:P)

CVSS Base Score	Impact Subscore	Exploitability Subscore
6.8/10	6.4/10	8.6/10

Exploit range	Attack complexity	Authentication
Remote	Medium	No required
Confidentiality impact	Integrity impact	Availability impact
Partial	Partial	Partial

Affected software
Microsoft -> Excel

References:

http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&item=7203336538

http://informationweek.com/story/showArticle.jhtml?articleID=174910198

http://news.com.com/2061-10789_3-5988086.html

http://news.zdnet.com/2100-1009_22-5989078.html

http://securityreason.com/securityalert/584

http://securityreason.com/securityalert/591

http://securitytracker.com/id?1015333

http://securitytracker.com/id?1015766

http://support.avaya.com/elmodocs2/security/ASA-2006-069.htm

http://www.dicks-blog.com/archives/2005/12/08/excel-vulnerability-for-sale/

http://www.eweek.com/article2/0,1759,1899697,00.asp?kc=EWRSS03129TX1K0000614

http://www.kb.cert.org/vuls/id/642428

http://www.securityfocus.com/archive/1/427635/100/0/threaded

http://www.securityfocus.com/archive/1/427698/100/0/threaded

http://www.securityfocus.com/bid/15780

http://www.securityfocus.com/news/11363

http://www.theage.com.au/news/breaking/excel-flaw-up-for-sale-on-ebay/2005/12/09/1134086783318.html

http://www.theregister.co.uk/2005/12/10/ebay_pulls_excel_vulnerability_auction/

http://www.us-cert.gov/cas/techalerts/TA06-073A.html

http://www.vupen.com/english/advisories/2006/0950

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-012

https://exchange.xforce.ibmcloud.com/vulnerabilities/23537

Vulnerability CVE-2005-4131

See advisories in our WLB2 database:

High

High Risk Vulnerability in Microsoft Excel

High

Microsoft Excel Named Range Arbitrary Code Execution

CWE-noinfo

CVSS2 => (AV:N/AC:M/Au:N/C:P/I:P/A:P)

6.8/10

6.4/10

8.6/10

Remote

Medium

No required

Partial

Partial

Partial

Affected software

References: