Microsoft Office 2000/2004/XP code injection

Summaryinfo

A vulnerability was found in Microsoft Office 2000/2004/XP. It has been rated as critical. This affects an unknown part. Performing a manipulation results in code injection. This vulnerability is reported as CVE-2006-1318. No exploit exists. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability, which was classified as very critical, was found in Microsoft Office 2000/2004/XP (Office Suite Software). This affects an unknown function. The manipulation with an unknown input leads to a code injection vulnerability. CWE is classifying the issue as CWE-94. The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, Office 2004 for Mac, and Office X for Mac do not properly parse record lengths, which allows remote attackers to execute arbitrary code via a malformed control in an Office document, aka "Microsoft Office Control Vulnerability."

The issue has been introduced in 06/07/1999. The weakness was disclosed 09/19/2014 as MS06-038 as confirmed bulletin (Technet). The advisory is shared at technet.microsoft.com. This vulnerability is uniquely identified as CVE-2006-1318 since 03/20/2006. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 03/29/2022). MITRE ATT&CK project uses the attack technique T1059 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 5583 days. During that time the estimated underground price was around $25k-$100k. The vulnerability scanner Nessus provides a plugin with the ID 22025 , which helps to determine the existence of the flaw in a target environment. The commercial vulnerability scanner Qualys is able to test this issue with plugin 110035 (Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (MS06-038)).

Applying the patch MS06-038 is able to eliminate this problem. The bugfix is ready for download at technet.microsoft.com.

The vulnerability is also documented in the databases at Tenable (22025) and Vulnerability Center (SBV-46221†). The entries VDB-2324, VDB-2367, VDB-29423 and VDB-31318 are pretty similar. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Office Suite Software

Vendor

• Microsoft

Name

• Office

Version

• 2000
• 2004
• XP

License

• commercial

Website

• Vendor: https://www.microsoft.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion