Signature Detail

HTTP: Microsoft Word Smart Tags Code Execution

This signature detects attempts to exploit a known vulnerability against Microsoft Office Word. A successful attack can lead to arbitrary code execution.

Extended Description

Microsoft Word is prone to a remote code-execution vulnerability. The issue arises because Word fails to properly handle malformed object pointers. Reports indicate that this issue can allow remote attackers to execute arbitrary code on a vulnerable computer by supplying a malicious Word document to a user. This issue is being actively exploited in the wild to place a backdoor named Backdoor.Ginwui on targeted computers through a trojan named Trojan.Mdropper.H.

Affected Products

• Microsoft Word 2002 SP1
• Microsoft Word 2002 SP2
• Microsoft Word 2002 SP3
• Microsoft Word 2002
• Microsoft Word 2003
• Microsoft Word Viewer 2003
• Microsoft Works Suite 2000
• Microsoft Works Suite 2001
• Microsoft Works Suite 2002
• Microsoft Works Suite 2003
• Microsoft Works Suite 2004
• Microsoft Works Suite 2005
• Microsoft Works Suite 2006

References

• BugTraq: 18037
• CVE: CVE-2006-2492