Signature Detail

HTTP: Microsoft Office Malformed GIF File Parser Overflow

This signature detects attempts to exploit a known vulnerability in the Microsoft Office GIF file parser. A successful attack can lead to a buffer overflow and arbitrary remote code execution within the context of the user.

Extended Description

Microsoft Office is prone to a remote code-execution vulnerability when handling a malformed GIF file. The issue occurs when an Office application such as Excel, Word, or PowerPoint tries to open a malformed GIF file. An attacker could exploit this vulnerability to corrupt memory and subsequently execute malicious code in the context of the user running the affected application.

Affected Products

• Microsoft Office 2000 SP1
• Microsoft Office 2000 SP2
• Microsoft Office 2000 SP3
• Microsoft Office 2000
• Microsoft Office 2000 Chinese Version
• Microsoft Office 2000 Japanese Version
• Microsoft Office 2000 Korean Version
• Microsoft Office 2003 SP1
• Microsoft Office 2003 SP2
• Microsoft Office 2003 SP3
• Microsoft Office 2003
• Microsoft Office XP SP1
• Microsoft Office XP SP2
• Microsoft Office XP SP3
• Microsoft Office XP
• Microsoft OneNote 2003
• Microsoft Project 2000
• Microsoft Project 2002 SP1
• Microsoft Project 2002
• Microsoft Project 2003 SP1
• Microsoft Project 2003

References

• BugTraq: 18915
• CVE: CVE-2006-0007