Microsoft Warns of Flaws in ActiveX Control

[InfoSec News <isn () c4i org>]

http://www.eweek.com/article2/0,3959,480448,00.asp

August 22, 2002 
By Dennis Fisher 

There are three security vulnerabilities in an ActiveX control
included in several of Microsoft Corp.'s most popular applications
that give an attacker the ability to execute code and read files on a
remote machine.

The flaw itself is in the Office Web Components (OWC) 2000 and 2002
software, which is included with Office 2000 and XP, BackOffice Server
2000, Internet Security and Acceleration Server 2000 and several other
Microsoft applications. With OWC, users get limited Office
functionality in a Web browser without having to install the entire
Office application.

Each of the three vulnerabilities can be exploited either with a Web
page or an HTML mail message. They are all the result of
implementation errors in functions that the Active X controls expose.

The flaw in the Host () function - which provides access to
application object models on a user's system - could enable an
attacker to open an Office application on a user's system and use
commands that would execute operating-system commands as the user,
Microsoft said in an advisory released Wednesday night.

The LoadText () function is used to load text into a browser window.  
The flaw allows an attacker to circumvent a safeguard that ensures Web
pages can only load text that they host. An attacker can specify a
text source within the Web page's domain and then use a server-side
redirect of the text to a file on a user's system.

The attacker could them read any file on the compromised machine. 

There is also a problem in the Copy()/Paste() functions, which ignore 
a security setting in Internet Explorer. The result is that an 
attacker can access the copy buffer and read any text it contains. 

The patch for these vulnerabilities is available here. [1]

Other affected applications include BackOffice Server 2000, BizTalk 
Server 2000 and 2002, Commerce Server 2000 and 2002, Money 2002 and 
2003, Project 2000 and Project Server 2002 and Small Business Server 
2000. 


[1] http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS02-044.asp



-
ISN is currently hosted by Attrition.org

To unsubscribe email majordomo () attrition org with 'unsubscribe isn'
in the BODY of the mail.