-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Relase Date: 2006-03-15 CVE: CVE-2006-0031 Affected Products: ================== Microsoft Office Excel 2000 Microsoft Office Excel XP Microsoft Office Excel 2003 Impact: ======= Microsoft Excel is a popular spreadsheet program of Microsoft Office product. Eyas of XFOCUS Security Team discovered a buffer overflow vulnerability when Excel processes a malicous ".xls" file, which might cause Excel to crash or even execute arbitrary code. Description: ============ Excel will initialize a stack buffer with 0x0e0e0e0e when it open a ".xls" file, but Excel uses a user-supplied length which will cause a stack buffer overflow. The following code is from excel v9.0.0.8924 >> >> .text:3003FE0C movzx eax, word ptr [ebx] >> .text:3003FE0F xor ecx, ecx >> .text:3003FE11 cmp eax, 0Eh >> .text:3003FE14 mov [ebp+var_8], ecx >> .text:3003FE17 jg loc_301C01B5 >> >> .text:301C01B5 mov byte ptr [ebp+ecx+var_138], cl >> .text:301C01BC inc ecx >> .text:301C01BD cmp ecx, 0Eh >> .text:301C01C0 jle short loc_301C01B5 >> .text:301C01C2 cmp ecx, eax >> .text:301C01C4 mov [ebp-8], ecx >> .text:301C01C7 jg loc_3003FFC9 >> .text:301C01CD sub eax, ecx >> .text:301C01CF lea edi, [ebp+ecx+var_138] >> .text:301C01D6 inc eax >> .text:301C01D7 mov edx, eax >> .text:301C01D9 mov eax, 0E0E0E0Eh >> .text:301C01DE mov ecx, edx >> .text:301C01E0 mov esi, ecx >> .text:301C01E2 shr ecx, 2 >> .text:301C01E5 rep stosd <== buffer overflow Vendor Status: ============== 2005.12.27 Informed the vendor. 2006.01.03 The vendor confirmed the vulnerability. 2006.03.14 The vendor releases a new version to fix the vulnerability. The vendor has released patch to fix this vulnerability, which is available for download at: http://www.microsoft.com/technet/security/Bulletin/MS06-012.mspx - -- Kind Regards, - --- XFOCUS Security Team http://www.xfocus.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (GNU/Linux) iD8DBQFEF5nIwhDwaF6cSWIRApKUAJ4/uJTH3wMPN2CtiePk59xqB9kJIwCePBoa 5DmfZj+YZc1IqX/EKsvyqBA= =EAQ7 -----END PGP SIGNATURE-----