SB2007050802 - Multiple vulnerabilities in Microsoft Word

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Memory corruption (CVE-ID: CVE-2007-1202)

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to boundary error when handling malformed properties in .rtf documents. A remote attacker can create a specially crafted RTF document, trick the victim into opening it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

2) Memory corruption (CVE-ID: CVE-2007-0035)

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to boundary error when handling malformed arrays in Word documents. A remote attacker can create a specially crafted MS Word document, trick the victim into opening it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Remediation

Install update from vendor's website.

References

• https://technet.microsoft.com/library/security/ms07-024