Signature Detail
Short Name |
HTTP:CGI:NULL-ENCODING |
|---|---|
Severity |
Info |
Recommended |
No |
Category |
HTTP |
Keywords |
Null Encoding |
Release Date |
2003/04/22 |
Update Number |
1213 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
HTTP: Null Encoding
This signature detects null characters (%00) in URLs. Attackers can use null characters to cause the Web server to produce unpredictable results.
Extended Description
A remote buffer overflow vulnerability affects Microsoft Office XP. The problem presents itself when an unsuspecting user follows a malicious HTML link that points to a Office document. A boundary condition error is exposed during this operation that may allow attacker-specified data to corrupt process memory. An attacker may leverage this issue to execute arbitrary code with the privileges of an unsuspecting user that follows a malicious embedded link.
Affected Products
- Microsoft Office XP SP1
- Microsoft Office XP SP2
- Microsoft Office XP SP3
- Microsoft Office XP
- Microsoft PowerPoint 2002 SP1
- Microsoft PowerPoint 2002 SP2
- Microsoft PowerPoint 2002 SP3
- Microsoft PowerPoint 2002
- Microsoft Project 2002 SP1
- Microsoft Project 2002
- Microsoft Visio 2002 SP1
- Microsoft Visio 2002 SP2
- Microsoft Visio 2002
- Microsoft Visio 2002 Professional SP2
- Microsoft Visio 2002 Standard SP2
- Microsoft Word 2002 SP1
- Microsoft Word 2002 SP2
- Microsoft Word 2002 SP3
- Microsoft Word 2002
- Microsoft Works Suite 2002
- Microsoft Works Suite 2003
- Microsoft Works Suite 2004
References
- CVE: CVE-2004-0848