Description
Buffer overflow in Microsoft Office 2000 SP3, XP SP3, and other versions and packages, allows user-assisted attackers to execute arbitrary code via a routing slip that is longer than specified by the provided length field, as exploited by malware such as TROJ_MDROPPER.BH and Trojan.PPDropper.E in attacks against PowerPoint.
References
- 20060422 PowerPoint Phishing Trojan mailing-list
- ADV-2006-3678 vdb-entry
- VU#682820 third-party-advisory
- oval:org.mitre.oval:def:1504 vdb-entry signature
- http://www.symantec.com/security_response/writeup.jsp?docid=2006-091810-5028-99
- ADV-2006-0950 vdb-entry
- oval:org.mitre.oval:def:1653 vdb-entry signature
- http://www.symantec.com/enterprise/research/SYMSA-2006-001.txt
- 20060822 Major updates in PowerPoint FAQ document - not a 0-day issue mailing-list
- 20059 vdb-entry
- 20060314 SYMSA-2006-001: Buffer overflow in Microsoft Office 2000, Office XP (2002), and Office 2003 Routing Slip Metadata mailing-list
- http://www.darkreading.com/document.asp?doc_id=101970
- 1016886 vdb-entry
- http://isc.sans.org/diary.php?storyid=1618
- http://blogs.securiteam.com/?author=28
- powerpoint-presentation-code-execution(29009) vdb-entry
- 17000 vdb-entry
- http://support.avaya.com/elmodocs2/security/ASA-2006-069.htm
- 19238 third-party-advisory
- http://blogs.securiteam.com/?p=557
- 20060919 Microsoft PowerPoint 0-day Vulnerability FAQ - September written mailing-list
- 1016720 vdb-entry
- http://blogs.securiteam.com/?p=559
- TA06-073A third-party-advisory
- office-routing-slip-bo(25009) vdb-entry
- 20060919 New PowerPoint 0-day Trojan in the wild mailing-list
- oval:org.mitre.oval:def:798 vdb-entry signature
- 19138 third-party-advisory
- oval:org.mitre.oval:def:1553 vdb-entry signature
- 23903 vdb-entry
- 20060819 New PowerPoint 0-day and Trojan - FAQ document ready mailing-list
- 20060919 New PowerPoint 0-day Trojan in the wild mailing-list
- 20060822 Major updates in PowerPoint FAQ document - not a 0-day issue mailing-list
- 1015766 vdb-entry
- http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_MDROPPER.BH
- MS06-012 vendor-advisory