Signature Detail

HTTP: Microsoft Office XP HTML Link Processing Remote Buffer Overflow

This signature detects attempts to exploit a known vulnerability against Microsoft Office XP. A successful attack could allow the attacker to execute arbitrary code on the targeted system. Failed exploit attempts could result in a denial of service condition.

Extended Description

A remote buffer overflow vulnerability affects Microsoft Office XP. The problem presents itself when an unsuspecting user follows a malicious HTML link that points to a Office document. A boundary condition error is exposed during this operation that may allow attacker-specified data to corrupt process memory. An attacker may leverage this issue to execute arbitrary code with the privileges of an unsuspecting user that follows a malicious embedded link.

Affected Products

• Microsoft Office XP SP1
• Microsoft Office XP SP2
• Microsoft Office XP SP3
• Microsoft Office XP
• Microsoft PowerPoint 2002 SP1
• Microsoft PowerPoint 2002 SP2
• Microsoft PowerPoint 2002 SP3
• Microsoft PowerPoint 2002
• Microsoft Project 2002 SP1
• Microsoft Project 2002
• Microsoft Visio 2002 SP1
• Microsoft Visio 2002 SP2
• Microsoft Visio 2002
• Microsoft Visio 2002 Professional SP2
• Microsoft Visio 2002 Standard SP2
• Microsoft Word 2002 SP1
• Microsoft Word 2002 SP2
• Microsoft Word 2002 SP3
• Microsoft Word 2002
• Microsoft Works Suite 2002
• Microsoft Works Suite 2003
• Microsoft Works Suite 2004

References

• BugTraq: 12480
• CVE: CVE-2004-0848