TUCoPS :: Windows Apps :: n-143.txt

Microsoft WordPerfect Converter Buffer Overrun Vulnerability (CIAC N-143)


             __________________________________________________________

                       The U.S. Department of Energy
                   Computer Incident Advisory Capability
                           ___  __ __    _     ___
                          /       |     /_\   /
                          \___  __|__  /   \  \___
             __________________________________________________________

                             INFORMATION BULLETIN

          Microsoft WordPerfect Converter Buffer Overrun Vulnerability
                     [Microsoft Security Bulletin MS03-036]

September 3, 2003 21:00 GMT                                       Number N-143
______________________________________________________________________________
PROBLEM:       A vulnerability exists in the WordPerfect Converter where 
               certain parameters are not validated correctly which could 
               result in an unchecked buffer. 
SOFTWARE:      Microsoft Office 97 
               Microsoft Office 2000 
               Microsoft Office XP 
               Microsoft Word 98 (J) 
               Microsoft FrontPage 2000 
               Microsoft FrontPage 2002 
               Microsoft Publisher 2000 
               Microsoft Publisher 2002 
               Microsoft Works Suite 2001 
               Microsoft Works Suite 2002 
               Microsoft Works Suite 2003 
DAMAGE:        An attacker could craft a malicious WordPerfect document 
               allowing them to run code of their choice if an application 
               using the converter is used to open the document. 
SOLUTION:      Apply the appropriate Microsoft patch as described in their 
               bulletin. 
______________________________________________________________________________
VULNERABILITY  The risk is MEDIUM. An attacker must entice a user to open the 
ASSESSMENT:    malicious document to be successful. The vulnerability cannot 
               be exploited automatically through e-mail as the user would 
               have to manually open the attachment for successful 
               exploitation. 
______________________________________________________________________________
LINKS: 
 CIAC BULLETIN:      http://www.ciac.org/ciac/bulletins/n-143.shtml 
 ORIGINAL BULLETIN:                                                           
                     http://www.microsoft.com/technet/treeview/default.asp?
                        url=/technet/security/bulletin/MS03-036.asp 
______________________________________________________________________________
[***** Start Microsoft Security Bulletin MS03-036 *****]

Microsoft Security Bulletin MS03-036  

Buffer Overrun in WordPerfect Converter Could Allow Code Execution (827103)
Originally posted: September 03, 2003

Summary
Who should read this bulletin: Customers who are using Microsoft® Office, 
Microsoft FrontPage®, Microsoft Publisher, or Microsoft Works Suite 

Impact of vulnerability: Run code of attacker’s choice 

Maximum Severity Rating: Important 

Recommendation: Customers who use any of the affected products that are 
listed below should apply the security patch at their earliest opportunity 

End User Bulletin:
An end user version of this bulletin is available at: 

http://www.microsoft.com/security/security_bulletins/ms03-036.asp. 

Affected Software: 

Microsoft Office 97 
Microsoft Office 2000 
Microsoft Office XP 
Microsoft Word 98 (J) 
Microsoft FrontPage 2000 
Microsoft FrontPage 2002 
Microsoft Publisher 2000 
Microsoft Publisher 2002 
Microsoft Works Suite 2001 
Microsoft Works Suite 2002 
Microsoft Works Suite 2003 

Technical details
Technical description: 

Microsoft Office provides a number of converters that allow users to import 
and edit files that use formats that are not native to Office. These 
converters are available as part of the default installation of Office and are 
also available separately in the Microsoft Office Converter Pack. These 
converters can be useful to organizations that use Office in a mixed 
environment with earlier versions of Office and other applications, including 
Office for the Macintosh and third-party productivity applications. 

There is a flaw in the way that the Microsoft WordPerfect converter handles 
Corel® WordPerfect documents. A security vulnerability results because the 
converter does not correctly validate certain parameters when it opens a 
WordPerfect document, which results in an unchecked buffer. As a result, an 
attacker could craft a malicious WordPerfect document that could allow code 
of their choice to be executed if an application that used the WordPerfect 
converter opened the document. Microsoft Word and Microsoft PowerPoint (which 
are part of the Office suite), FrontPage (which is available as part of the 
Office suite or separately), Publisher, and Microsoft Works Suite can all use 
the Microsoft Office WordPerfect converter. 

The vulnerability could only be exploited by an attacker who persuaded a user 
to open a malicious WordPerfect document—there is no way for an attacker to 
force a malicious document to be opened or to trigger an attack automatically 
by sending an e-mail message. 

Mitigating factors: 

* The user must open the malicious document for an attacker to be successful. 
  An attacker cannot force the document to be opened automatically. 
* The vulnerability cannot be exploited automatically through e-mail. A user 
  must open an attachment that is sent in an e-mail message for an e-mail-
  borne attack to be successful. 
  
Severity Rating: Microsoft Office (all versions) Important 
Microsoft FrontPage (all versions) Important 
Microsoft Publisher (all versions) Important 
Microsoft Works Suite (all versions) Important 
The above assessment is based on the types of systems affected by the 
vulnerability, their typical deployment patterns, and the effect that 
exploiting the vulnerability would have on them. 

Vulnerability identifier: CAN-2003-0666 

Tested Versions:

Microsoft tested Word 97, Word 98 (J), Word 2000, Word 2002, FrontPage 2000, 
FrontPage 2002, PowerPoint 97, PowerPoint 2000, PowerPoint 2002, Publisher 
2000, Publisher 2002, Works Suite 2001, Works Suite 2002, and Works Suite 
2003 to assess whether they are affected by this vulnerability. Previous 
versions are no longer supported and may or may not be affected by this 
vulnerability.


Patch availability

Download locations for this patch 
* Office XP, FrontPage 2002, Publisher 2002, Works 2002, and Works 2003: 
  http://microsoft.com/downloads/details.aspx?FamilyId=EC563DEE-6BFB-431D-
  B39E-2D672C0C223F&displaylang=en 

* Office 2000, FrontPage 2000, Publisher 2000, and Works 2001: 
  http://microsoft.com/downloads/details.aspx?FamilyId=D3ED4189-315A-411A-
  A739-F7181310FBA7&displaylang=en 

* Office 97 and Word 98(J): For information about how to receive support for 
  Word 97 and for Word 98(J) see the following Microsoft Knowledge Base 
  article: http://support.microsoft.com/default.aspx?scid=kb;en-us;827656 

* Microsoft recommends users visit Office Update at http://www.office.
  microsoft.com/ProductUpdates/default.aspx to detect and install this 
  security patch and all other public updates to Office family products 
  (note: Office Update does not support Office 97 or Visio 2000). 

Additional information about this patch

Installation platforms: 

* The Office XP patch can be installed on systems that are running Office XP 
  Service Pack 2, Microsoft Works 2002, and Microsoft Works 2003. The 
  administrative update can also be installed on systems that are running 
  Office XP Service Pack 1. 
* The Office 2000 patch can be installed on systems that are running Office 
  2000 Service Pack 3 and Works 2001. 
* For information about how to receive support for Office 97 and for Word 98(J)
  see the following Microsoft Knowledge Base article: http://support.microsoft.
  com/default.aspx?scid=kb;en-us;827656 

Inclusion in future service packs:
The fix for this issue will be included in any future service packs that are 
released for the affected products. 

Reboot needed: No 

Patch can be uninstalled: No 

Superseded patches: None. 

Verifying patch installation: 

For all affected products, verify that the version number of the wpft532.cnv 
file is 2002.1100.5510.0. 

Caveats:
None 

Localization:
Localized versions of this patch are available at the locations discussed in 
“Patch Availability”. 

Obtaining other security patches: 
Patches for other security issues are available from the following locations: 

* Security patches are available from the Microsoft Download Center, and can 
  be most easily found by doing a keyword search for "security_patch". 
* Patches for consumer platforms are available from the WindowsUpdate web 
  site 

Other information: 

Acknowledgments
Microsoft thanks eEye Digital Security for reporting this issue to us and 
working with us to protect customers. 

Support: 

* Microsoft Knowledge Base article http://support.microsoft.com/default.aspx
  ?scid=kb;en-us;827103 discusses this issue. Knowledge Base articles can be 
  found on the Microsoft Online Support web site. 
* Technical support is available from Microsoft Product Support Services. 
  There is no charge for support calls associated with security patches. 

Security Resources: The Microsoft TechNet Security Web Site provides 
additional information about security in Microsoft products. 

Disclaimer: 
The information provided in the Microsoft Knowledge Base is provided "as is" 
without warranty of any kind. Microsoft disclaims all warranties, either 
express or implied, including the warranties of merchantability and fitness 
for a particular purpose. In no event shall Microsoft Corporation or its 
suppliers be liable for any damages whatsoever including direct, indirect, 
incidental, consequential, loss of business profits or special damages, even 
if Microsoft Corporation or its suppliers have been advised of the possibility 
of such damages. Some states do not allow the exclusion or limitation of 
liability for consequential or incidental damages so the foregoing limitation 
may not apply. 

Revisions: 

V1.0 (September 03, 2003): Bulletin Created. 

[***** End Microsoft Security Bulletin MS03-036 *****]
_______________________________________________________________________________

CIAC wishes to acknowledge the contributions of Microsoft Corp. for the 
information contained in this bulletin.
_______________________________________________________________________________


CIAC, the Computer Incident Advisory Capability, is the computer
security incident response team for the U.S. Department of Energy
(DOE) and the emergency backup response team for the National
Institutes of Health (NIH). CIAC is located at the Lawrence Livermore
National Laboratory in Livermore, California. CIAC is also a founding
member of FIRST, the Forum of Incident Response and Security Teams, a
global organization established to foster cooperation and coordination
among computer security teams worldwide.

CIAC services are available to DOE, DOE contractors, and the NIH. CIAC
can be contacted at:
    Voice:    +1 925-422-8193 (7x24)
    FAX:      +1 925-423-8002
    STU-III:  +1 925-423-2604
    E-mail:   ciac@ciac.org

Previous CIAC notices, anti-virus software, and other information are
available from the CIAC Computer Security Archive.

   World Wide Web:      http://www.ciac.org/
   Anonymous FTP:       ftp.ciac.org

PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing
communities receive CIAC bulletins.  If you are not part of these
communities, please contact your agency's response team to report
incidents. Your agency's team will coordinate with CIAC. The Forum of
Incident Response and Security Teams (FIRST) is a world-wide
organization. A list of FIRST member organizations and their
constituencies can be obtained via WWW at http://www.first.org/.

This document was prepared as an account of work sponsored by an
agency of the United States Government. Neither the United States
Government nor the University of California nor any of their
employees, makes any warranty, express or implied, or assumes any
legal liability or responsibility for the accuracy, completeness, or
usefulness of any information, apparatus, product, or process
disclosed, or represents that its use would not infringe privately
owned rights. Reference herein to any specific commercial products,
process, or service by trade name, trademark, manufacturer, or
otherwise, does not necessarily constitute or imply its endorsement,
recommendation or favoring by the United States Government or the
University of California. The views and opinions of authors expressed
herein do not necessarily state or reflect those of the United States
Government or the University of California, and shall not be used for
advertising or product endorsement purposes.

LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC)

N-133: Blaster Worm (aka: W32.Blaster, MSBlast, Lovsan, Win32.Poza)
N-134: Sun cachefs Patches May Overwrite inetd.conf File
N-135: Microsoft Cumulative Patch for Internet Explorer 
N-136: Microsoft Unchecked Buffer in MDAC Function Vulnerability 
N-137: Red Hat Updated pam_smb packages fix remote buffer overflow
N-138: Red Hat Updated Sendmail packages fix vulnerability
N-139: Red Hat Updated SSL Certificate for access to 'up2date'
N-140: Sun Linux Vulnerability in VNC Package may allow local or remote unauthorized access
N-141: Timing based attack vulnerabilities in the JAVA Secure Socket Extension
N-142: Microsoft Word Macros Vulnerability




TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH