SANS Handler’s Diary October 7th 2004
Office BOF – might be exploitable
Well, next week will bring another round of Microsoft patching goodness, a hint of which came from Secunia:http://secunia.com/advisories/12758/
“HexView has discovered a vulnerability in Microsoft Word, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise a user’s system.”
“The vulnerability is caused due to an input validation error within the parsing of document files and may lead to a stack-based buffer overflow.”
IMHO, the best part of the advisory is the recommended solution – “Open trusted documents only.” Until details are made available, here are your options – choose any two:
- Don’t open documents that you can’t establish a complete chain of custody within your trusted domain
- Set your Internet Zone security to “High” and/or don’t download files that would be rendered by MS Word
- Don’t use Word. There are alternatives (ie. OpenOffice.org) that haven’t sufferred the same attention from exploit developers
- Cross your fingers and shoot dice
Now, I have no knowledge of the existence of such an inclusion in next week’s patches, nor would I be at liberty to discuss the details contained within that inclusion, if in fact, such an inclusion exists. Sir.
[My emphasis] Now that’s confidence inspiring 
Why were we using MS Office again?
