Signature Detail

HTTP: Microsoft Word Smart Tags Code Execution

This signature detects attempts to exploit a known vulnerability against Microsoft Office Word. A successful attack can lead to arbitrary code execution.

Extended Description

Microsoft Word is prone to a remote code-execution vulnerability. The issue arises because Word fails to properly handle malformed object pointers. Reports indicate that this issue can allow remote attackers to execute arbitrary code on a vulnerable computer by supplying a malicious Word document to a user. This issue is being actively exploited in the wild to place a backdoor named Backdoor.Ginwui on targeted computers through a trojan named Trojan.Mdropper.H.

Affected Products

• Microsoft word_2002 SP1
• Microsoft word_2002 SP2
• Microsoft word_2002 SP3
• Microsoft word_2002
• Microsoft word_2003
• Microsoft word_viewer_2003
• Microsoft works_suite_2000
• Microsoft works_suite_2001
• Microsoft works_suite_2002
• Microsoft works_suite_2003
• Microsoft works_suite_2004
• Microsoft works_suite_2005
• Microsoft works_suite_2006

References

• BugTraq: 18037
• CVE: CVE-2006-2492