A remote code execution vulnerability exists in Excel using a FNGROUPCOUNT value. An attacker could exploit the vulnerability by constructing a specially crafted Excel file that could allow remote code execution. Affected products include Microsoft Office 2000 SP3, XP SP3, 2003 SP1/SP2, Microsoft Works Suites, Microsoft Office X for Mac, Microsoft Office 2004 for Mac.
7e170a0ddb9ebcdf71cd28c1c7a522755c2b4ce84c61d85adab4ad42ff9c7f59
------=_Part_5447_16401853.1152673884138
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Microsoft Excel Could Allow Remote Code Execution by Malformed FNGROUPCOUNT
value Vulnerability
By OYXin( xin.ouyang at google mail ) of Nevis Labs
http://www.nevisnetworks.com
Vendor
Microsoft Inc.
Products affected:
Microsoft Office 2000 Service Pack 3
Microsoft Office XP Service Pack 3
Microsoft Office 2003 Service Pack 1 or Service Pack 2
Microsoft Works Suites
Microsoft Office X for Mac
Microsoft Office 2004 for Mac
Overview:
A remote code execution vulnerability exists in Excel using a FNGROUPCOUNT
value. An attacker could exploit the vulnerability by constructing a
specially crafted Excel file that could allow remote code execution.
Details:
The vulnerable code is similar to MS06-012(CVE-2006-0031) which found by
eyas.
==============================================================================
eax=0e0e0e0e ebx=0000fff1 ecx=00002241 edx=0000000f esi=00138964
edi=0013ffff
eip=30093040 esp=0013794c ebp=001388e4 iopl=0 nv up ei pl nz na
po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00010206
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for Excel.EXE -
Excel!Ordinal41+0x93040:
30093040 f3ab rep stosd
es:0013ffff=74634100
Excel!Ordinal41+0x9302e:
3009302e 5c pop esp
3009302f f3ffff rep ???
30093032 8bd9 mov ebx,ecx
30093034 c1e902 shr ecx,0x2
30093037 8d7c1520 lea edi,[ebp+edx+0x20]
3009303b b80e0e0e0e mov eax,0xe0e0e0e
30093040 f3ab rep stosd
> 0:000> g
> (b98.5fc): Access violation - code c0000005 (first chance) First
> chance exceptions are reported before any exception handling.
> This exception may be expected and handled.
> eax=00000000 ebx=00000000 ecx=0e0e0e0e edx=7c9037d8 esi=00000000
> edi=00000000
> eip=0e0e0e0e esp=0013757c ebp=0013759c iopl=0 nv up ei pl zr na
> po nc
> cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
> efl=00010246
> 0e0e0e0e ?? ???
==============================================================================
POC:
No POC will be supplied
Fix:
Microsoft has released an update for Microsoft Office which isset to address
this issue. This can be downloaded from:
http://www.microsoft.com/technet/security/bulletin/MS06-037.mspx
Vendor Response:
2006.04.12 Vendor notified via secure@microsoft.com
2006.04.12 Vendor responded
2006.07.11 Vendor released MS06-037 patch
2006.07.12 Advisory released
Reference:
1. http://sc.openoffice.org/excelfileformat.pdf
2. http://www.microsoft.com/technet/security/bulletin/MS06-037.mspx
3. http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1308
4. http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0031
Greetings to Nevis lab guys and 0x557 guys :)
------=_Part_5447_16401853.1152673884138
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Microsoft Excel Could Allow Remote Code Execution by Malformed FNGROUPCOUNT value Vulnerability<br><br>By OYXin( xin.ouyang at google mail ) of Nevis Labs<br><a href="http://www.nevisnetworks.com">http://www.nevisnetworks.com
</a><br><br><br>Vendor<br>Microsoft Inc.<br><br>Products affected:<br>Microsoft Office 2000 Service Pack 3<br>Microsoft Office XP Service Pack 3<br>Microsoft Office 2003 Service Pack 1 or Service Pack 2<br>Microsoft Works Suites
<br>Microsoft Office X for Mac <br>Microsoft Office 2004 for Mac <br><br><br>Overview:<br>A remote code execution vulnerability exists in Excel using a FNGROUPCOUNT value. An attacker could exploit the vulnerability by constructing a specially crafted Excel file that could allow remote code execution.
<br><br><br>Details:<br>The vulnerable code is similar to MS06-012(CVE-2006-0031) which found by eyas.<br><br>==============================================================================<br>eax=0e0e0e0e ebx=0000fff1 ecx=00002241 edx=0000000f esi=00138964
<br>edi=0013ffff<br>eip=30093040 esp=0013794c ebp=001388e4 iopl=0 nv up ei pl nz na <br>po nc<br>cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 <br>efl=00010206<br>*** ERROR: Symbol file could not be found. Defaulted to export
<br>symbols for Excel.EXE -<br>Excel!Ordinal41+0x93040:<br>30093040 f3ab rep stosd <br>es:0013ffff=74634100<br><br>Excel!Ordinal41+0x9302e:<br>3009302e 5c pop esp<br>3009302f f3ffff rep ???
<br>30093032 8bd9 mov ebx,ecx<br>30093034 c1e902 shr ecx,0x2<br>30093037 8d7c1520 lea edi,[ebp+edx+0x20]<br>3009303b b80e0e0e0e mov eax,0xe0e0e0e<br>30093040 f3ab rep stosd
<br><br>> 0:000> g<br>> (b98.5fc): Access violation - code c0000005 (first chance) First <br>> chance exceptions are reported before any exception handling.<br>> This exception may be expected and handled.<br>
> eax=00000000 ebx=00000000 ecx=0e0e0e0e edx=7c9037d8 esi=00000000 <br>> edi=00000000<br>> eip=0e0e0e0e esp=0013757c ebp=0013759c iopl=0 nv up ei pl zr na <br>> po nc<br>> cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
<br>> efl=00010246<br>> 0e0e0e0e ?? ???<br>==============================================================================<br><br>POC:<br>No POC will be supplied<br><br>Fix:<br>Microsoft has released an update for Microsoft Office which isset to address this issue. This can be downloaded from:
<br><a href="http://www.microsoft.com/technet/security/bulletin/MS06-037.mspx">http://www.microsoft.com/technet/security/bulletin/MS06-037.mspx</a><br><br><br>Vendor Response:<br>2006.04.12 Vendor notified via <a href="mailto:secure@microsoft.com">
secure@microsoft.com</a> <br>2006.04.12 Vendor responded<br>2006.07.11 Vendor released MS06-037 patch<br>2006.07.12 Advisory released<br><br><br>Reference:<br>1. <a href="http://sc.openoffice.org/excelfileformat.pdf">http://sc.openoffice.org/excelfileformat.pdf
</a><br>2. <a href="http://www.microsoft.com/technet/security/bulletin/MS06-037.mspx">http://www.microsoft.com/technet/security/bulletin/MS06-037.mspx</a><br>3. <a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1308">
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1308</a><br>4. <a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0031">http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0031</a><br><br>
<br>Greetings to Nevis lab guys and 0x557 guys :)<br><br>
------=_Part_5447_16401853.1152673884138--