=====================================================================
                                    CERT-Renater

                         Note d'Information No. 2006/VULN398
_____________________________________________________________________

DATE                      : 12/07/2006

HARDWARE PLATFORM(S)      : /

OPERATING SYSTEM(S)       : Microsfot Office 2003 et XP

======================================================================


MS06-039 - Microsoft Office Remote Code Execution Using a Malformed PNG/GIF
CVE-2006-0033 CVE-2006-0007

Affected Software:
    - Microsoft Office 2003 Service Pack 1 or Service Pack 2
       - Microsoft Project 2003
       - OneNote 2003
    - Microsoft Office XP Service Pack 3
    - Microsoft Office 2000 Service Pack 3
    - Microsoft Project 2002
    - Microsoft Project 2000
    - Microsoft Works Suites:
       - Microsoft Works Suite 2004
       - Microsoft Works Suite 2005
       - Microsoft Works Suite 2006

Non- Affected Software:
    - Microsoft Office Viewers
    - Microsoft Office 2004 for Mac
    - Microsoft Office v. X for Mac

A remote code execution vulnerability exists in Office and could be
exploited when Office opened a malformed PNG or GIF file. An attacker could
exploit the vulnerability by constructing a specially crafted PNG or GIF
file that could allow remote code execution.

If a user were logged on with administrative user rights, an attacker who
successfully exploited this vulnerability could take complete control of an
affected system. An attacker could then install programs; view, change, or
delete data; or create new accounts with full user rights. Users whose
accounts are configured to have fewer user rights on the system could be
less affected than users who operate with administrative user rights.
	
Mitigating Factors
- ------------------
    - An attacker who successfully exploited this vulnerability could gain
      the same user rights as the local user. Users whose accounts are
      configured to have fewer user rights on the system could be less
      impacted than users who operate with administrative user rights.

    - The vulnerability can not be exploited automatically through e-mail.
      For an attack to be successful a user must open an attachment that is
     sent in an e-mail message.

    - On Office XP and Office 2003, this vulnerability could not be
      exploited automatically through a Web-based attack scenario. An
      attacker would have to host a Web site that contains an Office file
      that is used to attempt to exploit this vulnerability. An attacker
      would have no way to force users to visit a malicious Web site.
      Instead, an attacker would have to persuade them to visit the Web site,
      typically by getting them to click a link that takes them to the
      attacker's site.

    - The default PNG and GIF filters provided by the operating system
      without Office installed is not affected by this vulnerability.

    Note: Office 2000 does not prompt the user to Open, Save, or Cancel
          before opening a document.
	
Workarounds
- -----------
Microsoft has tested the following workarounds. While these workarounds
will not correct the underlying vulnerability, they help block known attack
vectors. When a workaround reduces functionality, it is identified in the
following section.

Do not open or save Microsoft PNG or GIF files that you receive from
un-trusted sources or that you received unexpectedly from trusted sources.

This vulnerability could be exploited when a user opens a PNG or GIF file.

           =========================================================
           Les serveurs de référence du CERT-Renater
           http://www.urec.fr/securite
           http://www.cru.fr/securite
           http://www.renater.fr
           =========================================================
           + CERT-RENATER          | tel : 01-53-94-20-44          +
           + 151 bd de l'Hopital   | fax : 01-53-94-20-41          +
           + 75013 Paris           | email: certsvp@renater.fr     +
           =========================================================