what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

AD20060808.txt

AD20060808.txt
Posted Aug 18, 2006
Authored by Sowhat | Site nevisnetworks.com

A vulnerability Microsoft Powerpoint allows remote attackers to execute arbitrary code in the context of the logged in user. An array boundary condition may be violated by a malicious .PPT file in order to redirect execution into attacker-supplied data. Exploitation requires that the attacker coerce or persuade the victim to open a malicious .PPT file.

tags | advisory, remote, arbitrary
advisories | CVE-2006-3449
SHA-256 | 30b627d479aa605a484c97b5825eb6551f6f35f7202004e7be15e2a53a90f1cd

AD20060808.txt

Change Mirror Download
Microsoft PowerPoint Malformed Record Memory Corruption Vulnerability


By Sowhat of Nevis Labs
2006.08.08

http://www.nevisnetworks.com
http://secway.org/advisory/AD20060808.txt



Vendor
Microsoft Inc.

Microsoft PowerPoint 2000
Microsoft PowerPoint 2002
Microsoft Office PowerPoint 2003
PowerPoint 2004 for Mac
PowerPoint 2004 v. X for Mac


Remote: YES
Exploitable: maybe ;)

CVE: CVE-2006-3449



Overview:

This vulnerability allows remote attackers to execute arbitrary code in
the context of the logged in user. An array boundary condition may be
violated by a malicious .PPT file in order to redirect execution into
attacker-supplied data. Exploitation requires that the attacker coerce or
persuade the victim to open a malicious .PPT file.


Details:

The specific flaw exists within the parsing of the BIFF(?) file format used
by Microsoft PowerPoint.


There will be a memory corruption during the analysis of a malformed PPT Record.


The disassembly code:


3009a818 3945fc cmp [ebp-0x4],eax
3009a81b 7703 ja POWERPNT+0x9a820 (3009a820)
3009a81d 8b45fc mov eax,[ebp-0x4]
3009a820 8b7308 mov esi,[ebx+0x8]
3009a823 8b7d08 mov edi,[ebp+0x8]
3009a826 2945fc sub [ebp-0x4],eax
3009a829 014508 add [ebp+0x8],eax
3009a82c 8bc8 mov ecx,eax
3009a82e 8bd1 mov edx,ecx
3009a830 c1e902 shr ecx,0x2
3009a833 f3a5 rep movsd ----> Access violation here. :)
3009a835 8bca mov ecx,edx
3009a837 83e103 and ecx,0x3
3009a83a f3a4 rep movsb
3009a83c 014308 add [ebx+0x8],eax
3009a83f 014318 add [ebx+0x18],eax
3009a842 837dfc00 cmp dword ptr [ebp-0x4],0x0
3009a846 75b7 jnz POWERPNT+0x9a7ff (3009a7ff)
3009a848 8b450c mov eax,[ebp+0xc]
3009a84b 5f pop edi
3009a84c 5e pop esi
3009a84d 5b pop ebx
3009a84e c9 leave
3009a84f c20800 ret 0x8


Code execution may possible.


POC:

No POC will be supplied


Fix:

Microsoft has released an update for Microsoft Office which is
set to address this issue. This can be downloaded from:

http://www.microsoft.com/technet/security/bulletin/MS06-048.mspx


Vendor Response:

2006.07.14 Vendor notified via secure@microsoft.com
2006.07.15 Vendor responded
2006.08.08 Vendor released MS06-048 patch
2006.08.08 Advisory released


Common Vulnerabilities and Exposures (CVE) Information:

The Common Vulnerabilities and Exposures (CVE) project has assigned
the following names to these issues. These are candidates for
inclusion in the CVE list (http://cve.mitre.org), which standardizes
names for security problems.


CVE-2006-3449




Greetings to Becky PhD. ;)


Reference:

1. http://www.microsoft.com/technet/security/Bulletin/MS06-048.mspx
2. http://secway.org/vuln.htm



--
Sowhat
http://secway.org
"Life is like a bug, Do you know how to exploit it ?"
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close