Two Office flaws found in Month of ActiveX bugs

By on
Two Office flaws found in Month of ActiveX bugs

A hacker known as shinnai kicked off his "Month of ActiveX Bugs" (MoAxB) project with a bang by exposing a number of severe vulnerabilities affecting OCX controls in Microsoft Office.

Tracking firm Secunia rated the flaws as "highly critical," saying successful exploitation could permit malicious code execution.

The bugs residing in the PowerPoint Viewer, used to display presentations, are caused by boundary errors in the viewer’s ActiveX control that can lead to stack-based buffer overflows, according a Secunia advisory. The flaws are located in the program, PowerPointViewer.ocx, and affect version 3.1.0.3.

OCX is the former name for ActiveX controls.

The other flaws impact Excel Viewer and are similarly caused by boundary errors in the Excel Viewer ActiveX control, specifically ExcelViewer.ocx, Secunia said in a separate advisory. If taken advantage of, the same result can occur. They are confirmed in version 3.2.0.5.

shinnai said today on the moAxB blog that "this component allow(s) you to visualize, create and modify XLS files."

"Some methods are unable to handle exceptional conditions, and this cause(s) the crash of the application that use(s) this component."

The hacker said on Milw0rm today that the exploit has been tested on Windows XP Professional with Service Pack 2 and Internet Explorer 7 installed.

Users are encouraged to set the kill-bit for the affected ActiveX controls, according to Secunia. The kill-bit feature prevents ActiveX execution in a user’s web browser.

Microsoft said it is monitoring the MoAxB project, another effort by the hacking community to expose a month's worth of vulnerabilities in a variety of computer components and applications.

"As always, the Microsoft Security Response Center(MSRC) will stand ready to mobilise its teams to investigate, fix and learn from any vulnerabilities discovered through the project, and the company will take appropriate action to protect its customers, as needed," a company spokesman told SCMagazine.com.

He added that Microsoft prefers when researchers report flaws directly to the vendor to "ensure that customers receive comprehensive, high-quality updates for security vulnerabilities without exposure to malicious attackers while the update is being developed."

Tags:

Most Read Articles

You must be a registered member of iTnews to post a comment.
| Register

Poll

How should the costs of Australia's piracy scheme be split?
Rights holders should foot the whole bill
50/50
ISPs should foot the whole bill
Government should chip in a bit
Other
Flash is heading towards its grave, and that's...
Great! Good riddance
Sad! Flash had some good qualities
Irrelevant. I don't care
What's Flash?
View poll archive

Whitepapers from our sponsors

What will the stadium of the future look like?
What will the stadium of the future look like?
New technology adoption is pushing enterprise networks to breaking point
New technology adoption is pushing enterprise networks to breaking point
Gartner names IBM a 'Leader' for Disaster Recovery as a Service
Gartner names IBM a 'Leader' for Disaster Recovery as a Service
The next era of business continuity: Are you ready for an always-on world?
The next era of business continuity: Are you ready for an always-on world?

Log In

Username:
Password:
|  Forgot your password?