Signature Detail

HTTP: Microsoft Excel Malformed IMDATA Record Buffer Overflow

This signature detects attempts to exploit a known vulnerability against Microsoft Office Excel. Versions prior to and including Microsoft Office XP Service Pack 3 are vulnerable. Attackers can cause the execution of arbitrary code by supplying the victim with a maliciously crafted document.

Extended Description

Microsoft Excel is prone to a remote code-execution vulnerability. Attackers can exploit this issue to execute arbitrary code with the privileges of the user running the application, which can result in the compromise of affected computers.

Affected Products

• Microsoft excel_2000 SP2
• Microsoft excel_2000 SP3
• Microsoft excel_2000
• Microsoft excel_2002 SP1
• Microsoft excel_2002 SP2
• Microsoft excel_2002 SP3
• Microsoft excel_2002
• Microsoft excel_2003 SP1
• Microsoft excel_2003 SP2
• Microsoft excel_2003
• Microsoft excel_2004_for_mac
• Microsoft excel_x_for_mac
• Microsoft office_2000 SP1
• Microsoft office_2000 SP2
• Microsoft office_2000 SP3
• Microsoft office_2000
• Microsoft office_2003 SP1
• Microsoft office_2003 SP2
• Microsoft office_2003
• Microsoft office_excel_viewer_2003
• Microsoft office_xp SP1
• Microsoft office_xp SP2
• Microsoft office_xp SP3
• Microsoft office_xp
• Microsoft works_suite_2004
• Microsoft works_suite_2005
• Microsoft works_suite_2006

References

• CVE: CVE-2007-0027
• URL: http://www.microsoft.com/technet/security/bulletin/ms07-002.mspx