SecurityReason - Microsoft Office Excel Buffer Overflow Vulnerability

Advisory Text :

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Relase Date: 2006-03-15

CVE: CVE-2006-0031

Affected Products:
==================
Microsoft Office Excel 2000
Microsoft Office Excel XP
Microsoft Office Excel 2003

Impact:
=======

Microsoft Excel is a popular spreadsheet program of Microsoft Office
product.

Eyas of XFOCUS Security Team discovered a buffer overflow vulnerability
when Excel processes a malicous ".xls" file, which might cause Excel to
crash or even execute arbitrary code.

Description:
============

Excel will initialize a stack buffer with 0x0e0e0e0e when it open a
".xls" file, but Excel uses a user-supplied length which will cause a
stack buffer overflow.

The following code is from excel v9.0.0.8924

>>
>> .text:3003FE0C movzx eax, word ptr [ebx]
>> .text:3003FE0F xor ecx, ecx
>> .text:3003FE11 cmp eax, 0Eh
>> .text:3003FE14 mov [ebp+var_8], ecx
>> .text:3003FE17 jg loc_301C01B5
>>
>> .text:301C01B5 mov byte ptr [ebp+ecx+var_138], cl
>> .text:301C01BC inc ecx
>> .text:301C01BD cmp ecx, 0Eh
>> .text:301C01C0 jle short loc_301C01B5
>> .text:301C01C2 cmp ecx, eax
>> .text:301C01C4 mov [ebp-8], ecx
>> .text:301C01C7 jg loc_3003FFC9
>> .text:301C01CD sub eax, ecx
>> .text:301C01CF lea edi, [ebp+ecx+var_138]
>> .text:301C01D6 inc eax
>> .text:301C01D7 mov edx, eax
>> .text:301C01D9 mov eax, 0E0E0E0Eh
>> .text:301C01DE mov ecx, edx
>> .text:301C01E0 mov esi, ecx
>> .text:301C01E2 shr ecx, 2
>> .text:301C01E5 rep stosd <== buffer overflow

Vendor Status:
==============
2005.12.27 Informed the vendor.
2006.01.03 The vendor confirmed the vulnerability.
2006.03.14 The vendor releases a new version to fix the vulnerability.

The vendor has released patch to fix this vulnerability, which is
available for download at:
http://www.microsoft.com/technet/security/Bulletin/MS06-012.mspx

- --

Kind Regards,

- ---
XFOCUS Security Team
http://www.xfocus.org

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFEF5nIwhDwaF6cSWIRApKUAJ4/uJTH3wMPN2CtiePk59xqB9kJIwCePBoa
5DmfZj+YZc1IqX/EKsvyqBA=
=EAQ7
-----END PGP SIGNATURE-----