CERT-In Vulnerability Note CIVN-2007-103
Microsoft Windows OLE Automation Remote Code Execution vulnerability

Original Issue Date: August 16, 2007

Severity Rating: High


Systems Affected

• Microsoft Windows 2000 Advanced Server
• Microsoft Windows 2000 Datacenter Server
• Microsoft Windows 2000 Professional
• Microsoft Windows 2000 Server
• Microsoft Windows Server 2003 Datacenter Edition
• Microsoft Windows Server 2003 Enterprise Edition
• Microsoft Windows Server 2003 Standard Edition
• Microsoft Windows Server 2003 Web Edition
• Microsoft Windows XP Professional

Software Affected

• Microsoft Office 2004 for Mac
• Microsoft Visual Basic 6.x

Overview

Remote code execution vulnerability has been reported in Microsoft OLE Automation that could be exploited by an attacker to take complete control of the vulnerable system.


Description

In Microsoft Windows, applications programming, OLE Automation is the formal inter-process communication mechanism based on Component Object Model (COM).It provides an infrastructure whereby applications called automation controllers can access and manipulate shared automation objects that are exported by other applications.

The vulnerability in Object linking and embedding (OLE) Automation is caused due to insufficient input validation while processing certain script requests causes memory corruption. The attacker could exploit this vulnerability by creating a specially crafted web page .Opening this crafted webpage could corrupt memory and execute arbitrary code on the target system. The code will run with the privileges of the target user.

Workaround

• Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone

• Set Internet and Local intranet security zone settings to “High” to prompt before running ActiveX Controls and Active Scripting in these zones

Solution

Apply appropriate patches as mentioned in Microsoft Security Bulletin MS07-043


Vendor Information

Microsoft
http://www.microsoft.com/technet/security/bulletin/ms07-043.mspx


References

Secunia
http://secunia.com/advisories/26449/


CVE Name
CVE-2007-2224

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Communications and Information Technology
Electronics Niketan
6, C.G.O. Complex
New Delhi-110 003