Description
Stack-based buffer overflow in the HrShellOpenWithMonikerDisplayName function in Microsoft Hyperlink Object Library (hlink.dll) allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long hyperlink, as demonstrated using an Excel worksheet with a long link in Unicode, aka "Hyperlink COM Object Buffer Overflow Vulnerability." NOTE: this is a different issue than CVE-2006-3059.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Microsoft Excel - Unicode Local Overflow (PoC) EDB-1927 · dos · Jun 18, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 20060622 MS Excel Remote Code Execution POC Exploit mailing-list
- 20060622 RE: MS Excel Remote Code Execution POC Exploit mailing-list
- 20060623 Re: MS Excel Remote Code Execution POC Exploit mailing-list
- VU#394444 third-party-advisory
- 20060623 Re: Re: MS Excel Remote Code Execution POC Exploit mailing-list
- 20060808 TSRT-06-10: Microsoft HLINK.DLL Hyperlink Object Library Buffer Overflow Vulnerability mailing-list
- ADV-2006-2431 vdb-entry
- oval:org.mitre.oval:def:999 vdb-entry signature
- http://blogs.technet.com/msrc/archive/2006/06/20/437826.aspx
- 20060622 Re: MS Excel Remote Code Execution POC Exploit mailing-list
- 26666 vdb-entry
- excel-hlink-bo(27224) vdb-entry
- http://www.tippingpoint.com/security/advisories/TSRT-06-10.html
- 20060618 ***ULTRALAME*** Microsoft Excel Unicode Overflow mailing-list
- 20748 third-party-advisory
- MS06-050 vendor-advisory
- 18500 vdb-entry
- 1016339 vdb-entry