(Microsoft Issues Fix) Microsoft Excel 'Shockwave Flash Object' Lets Remote Users Execute Code Automatically
|
|
SecurityTracker Alert ID: 1017225 |
|
SecurityTracker URL: http://securitytracker.com/id/1017225
|
|
CVE Reference:
CVE-2006-3014
(Links to External Site)
|
Date: Nov 14 2006
|
Impact:
Execution of arbitrary code via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
|
Description:
A vulnerability was reported in Microsoft Excel. A remote user can cause arbitrary code to be executed on the target user's system.
A remote user can create an Excel file that includes a malicious Flash file embedded using the Excel 'Shockwave Flash Object' function. When the target user opens the Excel file, the Flash code will execute automatically without user interaction. The code will run with the privileges of the target user.
The vendor was notified on May 3, 2006.
Debasis Mohanty (aka Tr0y) discovered this vulnerability.
The original advisory, including a demonstration exploit, is available at:
http://hackingspirits.com/vuln-rnd/vuln-rnd.html
|
Impact:
A remote user can create a file that, when loaded by the target user, will execute arbitrary code on the target user's system.
|
Solution:
The vendor has issued the following fixes:
Microsoft Windows XP Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?FamilyId=93208e57-5f14-4fb2-bc0c-2c4f3c56274a
Microsoft Windows XP Professional x64 Edition:
http://www.microsoft.com/downloads/details.aspx?FamilyId=93208e57-5f14-4fb2-bc0c-2c4f3c56274a
A restart is not required.
The Microsoft advisory is available at:
http://www.microsoft.com/technet/security/bulletin/ms06-069.mspx
|
Vendor URL: www.microsoft.com/technet/security/bulletin/ms06-069.mspx (Links to External Site)
|
Cause:
Boundary error
|
Underlying OS:
Windows (XP)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Tue, 14 Nov 2006 13:15:54 -0500
Subject: Microsoft Security Bulletin MS06-069: Vulnerabilities in Macromedia Flash Player from Adobe Could Allow Remote Code Execution (923789)
|
http://www.microsoft.com/technet/security/bulletin/ms06-069.mspx
CVE-2006-3014
CVE-2006-3311
CVE-2006-3587
CVE-2006-3588
CVE-2006-4640
|
|
