Signature Detail
Short Name |
HTTP:STC:ACTIVEX:MSO-DATASRC |
|---|---|
Severity |
Medium |
Recommended |
No |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
Microsoft Office MSODataSourceControl ActiveX Control Denial of Service |
Release Date |
2007/06/20 |
Update Number |
1213 |
Supported Platforms |
di-5.3+, idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
HTTP: Microsoft Office MSODataSourceControl ActiveX Control Denial of Service
This signature detects attempts to exploit a known vulnerability in Microsoft Office. Attackers can create malicious Web pages containing dangerous ActiveX controls, which if accessed by a victim, can allow an attacker to gain control of the victim's client browser.
Extended Description
Microsoft Office MSODataSourceControl ActiveX Control is prone to a buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer. Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts will likely result in denial-of-service conditions.
Affected Products
- Microsoft Office 2003 SP1
- Microsoft Office 2003 SP2
- Microsoft Office 2003 SP3
- Microsoft Office 2003
References
- BugTraq: 24462
- CVE: CVE-2007-3282