===================================================================== CERT-Renater Note d'Information No. 2006/VULN438 _____________________________________________________________________ DATE : 09/08/2006 HARDWARE PLATFORM(S) : / OPERATING SYSTEM(S) : Powerpoint 2000 a 2004 ====================================================================== MS06-048 - Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (922968) Affected Software: - Microsoft Office 2000 Service Pack 3 - Microsoft PowerPoint 2000 - Microsoft Office XP Service Pack 3 - Microsoft PowerPoint 2002 - Microsoft Office 2003 Service Pack 1 or Service Pack 2 - Microsoft Office PowerPoint 2003 - Microsoft Office 2004 for Mac - PowerPoint 2004 for Mac - Microsoft Office v. X for Mac - PowerPoint 2004 v. X for Mac Non-Affected Software: - Microsoft PowerPoint 2003 Viewer - Microsoft Works Suites: - Microsoft Works Suite 2004 - Microsoft Works Suite 2005 - Microsoft Works Suite 2006 Full MS06-048 advisory: http://www.microsoft.com/technet/security/Bulletin/MS06-048.mspx Vulnerability Details Microsoft PowerPoint Mso.dll Vulnerability - CVE-2006-3590 A remote code execution vulnerability exists in PowerPoint and could be exploited when a file containing a malformed shape container is parsed by PowerPoint. Such a file might be included in an e-mail attachment or hosted on a malicious web site. An attacker could exploit the vulnerability by constructing a specially crafted PowerPoint file that could allow remote code execution. Microsoft PowerPoint Malformed Record Vulnerability - CVE-2006-3449 A remote code execution vulnerability exists in PowerPoint and could be exploited when a file containing a malformed record is parsed by PowerPoint. Such a file might be included in an e-mail attachment or hosted on a malicious web site. An attacker could exploit the vulnerability by constructing a specially crafted PowerPoint file that could allow remote code execution. If a user were logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less affected than users who operate with administrative user rights. ========================================================= Les serveurs de référence du CERT-Renater http://www.urec.fr/securite http://www.cru.fr/securite http://www.renater.fr ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 151 bd de l'Hopital | fax : 01-53-94-20-41 + + 75013 Paris | email: certsvp@renater.fr + =========================================================