Signature Detail

HTTP: Microsoft Works File Converter WPS File Processing Buffer Overflow

This signature detects attempts to exploit a known vulnerability in Microsoft Products Works File Converter. A successful attack can lead to a buffer overflow and arbitrary remote code execution within the context of the client.

Extended Description

Microsoft Office Works for Windows document converters are prone to a remote code-execution vulnerability because the application fails to properly handle specially crafted files. An attacker could exploit this issue by enticing a victim to open a malicious '.wps' file. Successful exploits would allow the attacker to execute arbitrary code in the context of the currently logged-in user.

Affected Products

• Microsoft Office 2000 SP3
• Microsoft Office 2003 SP3
• Microsoft Office 2007 SP1
• Microsoft Office XP SP3
• Microsoft Works 8.5
• Microsoft Works 9.0

References

• BugTraq: 35184
• CVE: CVE-2009-1533