Signature Detail

HTTP: Microsoft Word Documents Memory Corruption

This signature detects attempts to exploit a known vulnerability agains Microsoft Word file format document parser. A successful attack can lead to arbitrary remote code execution within the context of the user.

Extended Description

Microsoft Word is prone to a remote code-execution vulnerability. An attacker could exploit this issue by enticing a victim to open a malicious Word file. If the attack is successful, the attacker may be able to execute arbitrary code in the context of the currently logged-in user. Note that this issue is distinct from issues described in BID 21451 (Microsoft Word Malformed String Arbitrary Remote Code Execution Vulnerability) and BID 21518 (Microsoft Word Malformed Data Structures Code Execution Vulnerability).

Affected Products

• Microsoft Office 2000 SP1
• Microsoft Office 2000 SP2
• Microsoft Office 2000 SP3
• Microsoft Office 2000
• Microsoft Office 2000 Chinese Version
• Microsoft Office 2000 Japanese Version
• Microsoft Office 2000 Korean Version
• Microsoft Office 2002
• Microsoft Office 2003 SP1
• Microsoft Office 2003 SP2
• Microsoft Office 2003 SP3
• Microsoft Office 2003
• Microsoft Office 2004 for Mac
• Microsoft Office XP SP1
• Microsoft Office XP SP2
• Microsoft Office XP SP3
• Microsoft Office XP
• Microsoft Office XP Developer Edition
• Microsoft Word 2000 SP2
• Microsoft Word 2000 SP3
• Microsoft Word 2000 SR1
• Microsoft Word 2000 Sr1a
• Microsoft Word 2000
• Microsoft Word 2000 Chinese Version
• Microsoft Word 2000 Japanese Version
• Microsoft Word 2000 Korean Version
• Microsoft Word 2002 SP1
• Microsoft Word 2002 SP2
• Microsoft Word 2002 SP3
• Microsoft Word 2002
• Microsoft Word 2003
• Microsoft Word 2004 for Mac
• Microsoft Word Viewer 2003
• Microsoft Word X for Mac
• Microsoft Works Suite 2004
• Microsoft Works Suite 2005
• Microsoft Works Suite 2006

References

• BugTraq: 19414
• BugTraq: 21589
• CVE: CVE-2006-3649
• CVE: CVE-2006-6561