Total Members: 14197
Posted by: Amker
« on: 17. May 2007., 16:16:24 »Type Buffer Overflow
Impact of exploitation Remote Code Execution
User Interaction user interaction is needed
Attack Vector Maliciously Crafted File
Rating Medium
CVE reference CVE-2007-0035,
Vendor Status Responded and patched
Vulnerable systems
Microsoft Word 2000,
Microsoft Word 2002,
Microsoft Word 2003,
Microsoft Word Viewer 2003,
Office for Mac 2004,
Microsoft Works Suite 2004,
Microsoft Works Suite 2005,
Microsoft Works Suite 2006,
Summary A vulnerability in Microsoft Word may allow for remote code execution attacks.
Description -
Microsoft Word is an industry-standard word-processing application developed by Microsoft. A vulnerability in Microsoft Word may allow for remote code execution attacks. A specially crafted Word document could trigger an array overflow error in Word. A user would have to visit a malicious Web site hosting a specially crafted Word document or open such an email attachment for an attack to occur. Code execution would be at the level of the logged-on user.
Recommendations -
Download and install the patch available from Microsoft (934232): http://www.microsoft.com/technet/security/Bulletin/MS07-024.mspx
McAfee Product Mitigation
McAfee Foundstone
This Foundstone vulnerability check can be used to assess if your systems are vulnerable and is expected to accurately identify if a system is vulnerable in many enterprise environments.
Signature:
(MS07-024) Microsoft Word Array Overflow (934232)
Signature identifier:
5125
Release date:
5/8/2007
McAfee Intrushield
This signature provides coverage for this vulnerability. McAfee Avert Labs will continue to update our coverage, as needed, as new exploit vectors are discovered and as new threats emerge.
Signature:
HTTP: Microsoft Word Array Overflow
Signature identifier:
0x40236000
Release date:
5/8/2007
First released in:
Sigset 3.1.39
McAfee Host IPS
Out of the box, HIPS protects against many buffer overflow exploits. McAfee Avert Labs will continue to update our coverage, as needed, as new exploit vectors are discovered and as new threats emerge.
Signature:
Generic buffer overflow protection
Signature identifier:
428
Release date:
8/24/2000
First released in:
2.0
McAfee VirusScan Enterprise 8.0i (VSE8.0i) / Managed Virus Scan (MVS) Buffer Overflow Protection
Out of the box, VSE8.0i and MVS protects against many buffer overflow exploits. McAfee Avert Labs will continue to update our coverage, as needed, as new exploit vectors are discovered and as new threats emerge.
Signature:
Buffer Overflow Protection
Release date:
8/30/2004
First released in:
build 131
Additional Resources -
Microsoft Security Bulletin MS07-024: Vulnerabilities in Microsoft Word Could Allow Remote Code Execution (934232)
Impact of exploitation Remote Code Execution
User Interaction user interaction is needed
Attack Vector Maliciously Crafted File
Rating Medium
CVE reference CVE-2007-0035,
Vendor Status Responded and patched
Vulnerable systems
Microsoft Word 2000,
Microsoft Word 2002,
Microsoft Word 2003,
Microsoft Word Viewer 2003,
Office for Mac 2004,
Microsoft Works Suite 2004,
Microsoft Works Suite 2005,
Microsoft Works Suite 2006,
Summary A vulnerability in Microsoft Word may allow for remote code execution attacks.
Description -
Microsoft Word is an industry-standard word-processing application developed by Microsoft. A vulnerability in Microsoft Word may allow for remote code execution attacks. A specially crafted Word document could trigger an array overflow error in Word. A user would have to visit a malicious Web site hosting a specially crafted Word document or open such an email attachment for an attack to occur. Code execution would be at the level of the logged-on user.
Recommendations -
Download and install the patch available from Microsoft (934232): http://www.microsoft.com/technet/security/Bulletin/MS07-024.mspx
McAfee Product Mitigation
McAfee Foundstone
This Foundstone vulnerability check can be used to assess if your systems are vulnerable and is expected to accurately identify if a system is vulnerable in many enterprise environments.
Signature:
(MS07-024) Microsoft Word Array Overflow (934232)
Signature identifier:
5125
Release date:
5/8/2007
McAfee Intrushield
This signature provides coverage for this vulnerability. McAfee Avert Labs will continue to update our coverage, as needed, as new exploit vectors are discovered and as new threats emerge.
Signature:
HTTP: Microsoft Word Array Overflow
Signature identifier:
0x40236000
Release date:
5/8/2007
First released in:
Sigset 3.1.39
McAfee Host IPS
Out of the box, HIPS protects against many buffer overflow exploits. McAfee Avert Labs will continue to update our coverage, as needed, as new exploit vectors are discovered and as new threats emerge.
Signature:
Generic buffer overflow protection
Signature identifier:
428
Release date:
8/24/2000
First released in:
2.0
McAfee VirusScan Enterprise 8.0i (VSE8.0i) / Managed Virus Scan (MVS) Buffer Overflow Protection
Out of the box, VSE8.0i and MVS protects against many buffer overflow exploits. McAfee Avert Labs will continue to update our coverage, as needed, as new exploit vectors are discovered and as new threats emerge.
Signature:
Buffer Overflow Protection
Release date:
8/30/2004
First released in:
build 131
Additional Resources -
Microsoft Security Bulletin MS07-024: Vulnerabilities in Microsoft Word Could Allow Remote Code Execution (934232)