PCWorks: Vulnerabilities in Microsoft Office, Frontpage, Excel, Publisher, and Expression

TITLE:
Microsoft Office Drawing Object Code Execution
Vulnerability

SECUNIA ADVISORY ID:
SA25178

VERIFY ADVISORY:
http://secunia.c
om/advisories/25178/

CRITICAL:
Highly critical

IMPACT:
System access

WHERE:
>From remote

SOFTWARE:
Microsoft Publisher 2003
http://secunia.com/
product/10986/
Microsoft Publisher 2002
http://secunia.com/pro
duct/30/
Microsoft Publisher 2000
http://secunia.com/pro
duct/29/
Microsoft Office XP
http://secunia.com/pro
duct/23/
Microsoft Office SharePoint Designer 2007
http://secunia.com/
product/14163/
Microsoft Office Publisher 2007
http://secunia.com/
product/14162/
Microsoft Office Excel 2007
http://secunia.com/
product/14161/
Microsoft Office 2007
http://secunia.com/
product/13228/
Microsoft Office 2004 for Mac
http://secunia.com/p
roduct/8713/
Microsoft Office 2003 Student and Teacher Edition
http://secunia.com/p
roduct/2278/
Microsoft Office 2003 Standard Edition
http://secunia.com/p
roduct/2275/
Microsoft Office 2003 Small Business Edition
http://secunia.com/p
roduct/2277/
Microsoft Office 2003 Professional Edition
http://secunia.com/p
roduct/2276/
Microsoft Office 2000
http://secunia.com/pro
duct/24/
Microsoft Frontpage 2003
http://secunia.com/p
roduct/6997/
Microsoft Frontpage 2002
http://secunia.com/pro
duct/26/
Microsoft Frontpage 2000
http://secunia.com/pro
duct/27/
Microsoft Excel Viewer 2003
http://secunia.com/p
roduct/7700/
Microsoft Excel 2003
http://secunia.com/p
roduct/4970/
Microsoft Excel 2002
http://secunia.com/p
roduct/4043/
Microsoft Excel 2000
http://secunia.com/p
roduct/3054/
Microsoft Expression Web 1.x
http://secunia.com/
product/14164/

DESCRIPTION:
A vulnerability has been reported in Microsoft Office, which

can be
exploited by malicious people to compromise a user's
system.

The vulnerability is caused due to an unspecified error in
the
parsing of drawing objects and can be exploited via a
malicious
Office file containing a specially crafted drawing object.

Successful exploitation allows execution of arbitrary code.

SOLUTION:
Apply patches.

Microsoft Office 2000 SP3:
http://www.microsof
t.com/downloads/details.aspx?FamilyId=A693C271-4B94-4541-953
A-0A2DB4587B23

Microsoft Office XP SP3:
http://www.microsof
t.com/downloads/details.aspx?FamilyId=CB291AD9-348A-4C28-BEC
7-53D2F35D0B72

Microsoft Office 2003 SP2:
http://www.microsof
t.com/downloads/details.aspx?FamilyId=819857CC-3777-4E4A-9CC
3-685FC079A254

Microsoft Office System 2007:
http://www.microsof
t.com/downloads/details.aspx?FamilyId=A3DC8E3F-90DD-4D0C-88B
8-2EC88FF3A588

Microsoft Office 2004 for Mac:
http://www.microsoft.com
/mac

PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.

ORIGINAL ADVISORY:
MS07-025 (KB934873):
http://www.microsoft.com/technet/security/Bullet
in/MS07-025.mspx
============= PCWorks Mailing List =================
Don't see your post? Check our posting guidelines &
make sure you've followed proper posting procedures,
http://pcworkers.com/r
ules.htm
Contact list owner <owner-pcworksimagicomm.com>
Unsubscribing and other changes: http://pcworkers.com
=====================================================