Executive Summary
| Summary | |
|---|---|
| Title | Vulnerability in Word Could Allow Remote Code Execution |
| Informations | |||
|---|---|---|---|
| Name | KB919637 | First vendor Publication | 2005-05-10 |
| Vendor | Microsoft | Last vendor Modification | 2006-06-13 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 9.3 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Microsoft has completed the investigation into a public report of a vulnerability. We have issued a security bulletin to address this issue. For more information about this issue, including download links for an available security update, please review the security bulletin . The vulnerability addressed is the “Microsoft Word Malformed Object Pointer Vulnerability - CVE-2006-1359”. |
Original Source
| Url : http://www.microsoft.com/technet/security/advisory/919637.mspx |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-94 | Failure to Control Generation of Code ('Code Injection') |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:1178 | |||
| Oval ID: | oval:org.mitre.oval:def:1178 | ||
| Title: | IE6 DHTML Method Call Memory Corruption (Server 2003) | ||
| Description: | Microsoft Internet Explorer 6 and 7 Beta 2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a certain createTextRange call on a checkbox object, which results in a dereference of an invalid table pointer. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2006-1359 | Version: | 5 |
| Platform(s): | Microsoft Windows Server 2003 | Product(s): | Microsoft Internet Explorer |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:1418 | |||
| Oval ID: | oval:org.mitre.oval:def:1418 | ||
| Title: | Microsoft Word2003 Malformed Object Pointer Vulnerability | ||
| Description: | Buffer overflow in Microsoft Word in Office 2000 SP3, Office XP SP3, Office 2003 Sp1 and SP2, and Microsoft Works Suites through 2006, allows user-assisted attackers to execute arbitrary code via a malformed object pointer, as originally reported by ISC on 20060519 for a zero-day attack. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2006-2492 | Version: | 3 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 | Product(s): | Microsoft Word |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:1657 | |||
| Oval ID: | oval:org.mitre.oval:def:1657 | ||
| Title: | IE6 DHTML Method Call Memory Corruption (Server 2003,SP1) | ||
| Description: | Microsoft Internet Explorer 6 and 7 Beta 2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a certain createTextRange call on a checkbox object, which results in a dereference of an invalid table pointer. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2006-1359 | Version: | 4 |
| Platform(s): | Microsoft Windows Server 2003 | Product(s): | Microsoft Internet Explorer |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:1678 | |||
| Oval ID: | oval:org.mitre.oval:def:1678 | ||
| Title: | IE 5.01 DHTML Method Call Memory Corruption | ||
| Description: | Microsoft Internet Explorer 6 and 7 Beta 2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a certain createTextRange call on a checkbox object, which results in a dereference of an invalid table pointer. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2006-1359 | Version: | 8 |
| Platform(s): | Microsoft Windows 2000 | Product(s): | Microsoft Internet Explorer |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:1702 | |||
| Oval ID: | oval:org.mitre.oval:def:1702 | ||
| Title: | IE6 DHTML Method Call Memory Corruption (Win2K/XP,SP1) | ||
| Description: | Microsoft Internet Explorer 6 and 7 Beta 2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a certain createTextRange call on a checkbox object, which results in a dereference of an invalid table pointer. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2006-1359 | Version: | 9 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP | Product(s): | Microsoft Internet Explorer |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:1738 | |||
| Oval ID: | oval:org.mitre.oval:def:1738 | ||
| Title: | Microsoft Word2002 Malformed Object Pointer Vulnerability | ||
| Description: | Buffer overflow in Microsoft Word in Office 2000 SP3, Office XP SP3, Office 2003 Sp1 and SP2, and Microsoft Works Suites through 2006, allows user-assisted attackers to execute arbitrary code via a malformed object pointer, as originally reported by ISC on 20060519 for a zero-day attack. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2006-2492 | Version: | 3 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 | Product(s): | Microsoft Word |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:2068 | |||
| Oval ID: | oval:org.mitre.oval:def:2068 | ||
| Title: | Microsoft Word2000 Malformed Object Pointer Vulnerability | ||
| Description: | Buffer overflow in Microsoft Word in Office 2000 SP3, Office XP SP3, Office 2003 Sp1 and SP2, and Microsoft Works Suites through 2006, allows user-assisted attackers to execute arbitrary code via a malformed object pointer, as originally reported by ISC on 20060519 for a zero-day attack. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2006-2492 | Version: | 3 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 | Product(s): | Microsoft Word |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:985 | |||
| Oval ID: | oval:org.mitre.oval:def:985 | ||
| Title: | IE6 DHTML Method Call Memory Corruption (WinXP) | ||
| Description: | Microsoft Internet Explorer 6 and 7 Beta 2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a certain createTextRange call on a checkbox object, which results in a dereference of an invalid table pointer. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2006-1359 | Version: | 5 |
| Platform(s): | Microsoft Windows XP | Product(s): | Microsoft Internet Explorer |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 3 | |
| Application | 1 | |
| Application | 1 |
SAINT Exploits
| Description | Link |
|---|---|
| Internet Explorer createTextRange memory corruption | More info here |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 25635 | Microsoft Word Unspecified Code Execution Microsoft Word contains a flaw that may allow a malicious user to execute arbitrary code under the security context of the current user. The issue is triggered due to an unspecified error when processing object pointers. It is possible that the flaw may allow arbitrary code execution resulting in a loss of integrity. |
| 24050 | Microsoft IE createTextRange() Function Arbitrary Code Execution Microsoft Internet Explorer contains a flaw that may allow a malicious user to execute arbitrary commands. The issue is triggered due to a memory corruption error when processing a specially crafted "createTextRange()" call associated with a "checkbox" object. It is possible that the flaw may allow attackers to remotely take complete control of an affected system resulting in a loss of integrity. |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2014-01-10 | Microsoft Office Word Smart Tags code execution attempt RuleID : 21677 - Revision : 5 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office Word Smart Tags code execution attempt RuleID : 21676 - Revision : 5 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office Word Smart Tags code execution attempt RuleID : 21675 - Revision : 5 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office Word Smart Tags code execution attempt RuleID : 21674 - Revision : 5 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Internet Explorer createTextRange code execution attempt RuleID : 18313 - Revision : 6 - Type : BROWSER-IE |
| 2014-01-10 | Microsoft Internet Explorer createTextRange code execution attempt RuleID : 17781 - Revision : 4 - Type : SPECIFIC-THREATS |
| 2014-01-10 | Microsoft Internet Explorer createTextRange code execution attempt RuleID : 17263 - Revision : 7 - Type : BROWSER-IE |
| 2014-01-10 | Microsoft Internet Explorer createTextRange code execution attempt RuleID : 17262 - Revision : 6 - Type : BROWSER-IE |
| 2014-01-10 | Microsoft Internet Explorer createTextRange code execution attempt RuleID : 17261 - Revision : 10 - Type : BROWSER-IE |
| 2014-01-10 | Microsoft Internet Explorer createTextRange code execution attempt RuleID : 16690 - Revision : 9 - Type : BROWSER-IE |
| 2014-01-10 | Microsoft Internet Explorer createTextRange code execution attempt RuleID : 16035 - Revision : 12 - Type : BROWSER-IE |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2006-06-13 | Name : Arbitrary code can be executed on the remote host through Microsoft Word. File : smb_nt_ms06-027.nasl - Type : ACT_GATHER_INFO |
| 2006-04-11 | Name : Arbitrary code can be executed on the remote host through the web client. File : smb_nt_ms06-013.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2013-05-11 12:20:21 |
|
