Vulnerability

CERT-In Vulnerability Note CIVN-2004-0056
Vulnerability in Microsoft Excel Could Allow Remote Code Execution

Original Issue Date:October 15, 2004

Severity Rating: HIGH

Systems Affected

Microsoft Office 2000 Software Service Pack 3 with Excel 2000
Microsoft Office XP INSERT INTO VLNOTES_AFFECTED ( VLNOTES_CODE, AFFECTED, DETAILS ) VALUES ( ; Microsoft Office XP Service Pack 2 with Excel 2002
Microsoft Office 2001 for Mac with Excel 2001 for Mac
Microsoft Office v. X for Mac with Excel v. X for Mac

Overview

A vulnerability exists in Microsoft Excel, which can cause a Denial of Service and compromise a user's system if exploited by a malicious user.

Impact

Remote Code Execution

Description

A vulnerability exists in Microsoft Excel caused due to a boundary error when handling Excel files and can be exploited to cause a stack-based buffer overflow. Successful exploitation of this vulnerability allows execution of arbitrary code, but requires that a user is tricked into opening a malicious Excel file or visit a malicious web site.

If a user is logged on with administrative privileges, an attacker who successfully exploited this vulnerability could take complete control of an affected system, users logged on with fewer privileges would be at less risk.

Solution

Apply the appropriate Security update as mentioned in Microsoft Security Bulletin MS04-033

Vendor Information

Microsoft Corporation
Microsoft Security Bulletin MS04-033

References

Secunia Advisory SA12800

http://secunia.com/advisories/12800/

SecurityTracker Alert ID: 1011635

http://securitytracker.com/alerts/2004/Oct/1011635.html

CVE Name
CAN-2004-0846

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-2436857

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India