=====================================================================
                                    CERT-Renater

                         Note d'Information No. 2006/VULN438
_____________________________________________________________________

DATE                      : 09/08/2006

HARDWARE PLATFORM(S)      : /

OPERATING SYSTEM(S)       : Powerpoint 2000 a 2004

======================================================================

MS06-048 - Vulnerabilities in Microsoft Office Could Allow Remote
Code Execution (922968)

Affected Software:
     - Microsoft Office 2000 Service Pack 3
     - Microsoft PowerPoint 2000
     - Microsoft Office XP Service Pack 3
     - Microsoft PowerPoint 2002
     - Microsoft Office 2003 Service Pack 1 or Service Pack 2
     - Microsoft Office PowerPoint 2003
     - Microsoft Office 2004 for Mac
     - PowerPoint 2004 for Mac
     - Microsoft Office v. X for Mac
     - PowerPoint 2004 v. X for Mac

Non-Affected Software:
     - Microsoft PowerPoint 2003 Viewer
     - Microsoft Works Suites:
     - Microsoft Works Suite 2004
     - Microsoft Works Suite 2005
     - Microsoft Works Suite 2006

Full MS06-048 advisory:
http://www.microsoft.com/technet/security/Bulletin/MS06-048.mspx

Vulnerability Details

Microsoft PowerPoint Mso.dll Vulnerability - CVE-2006-3590

     A remote code execution vulnerability exists in PowerPoint and could
     be exploited when a file containing a malformed shape container is
     parsed by PowerPoint. Such a file might be included in an e-mail
     attachment or hosted on a malicious web site. An attacker could exploit
     the vulnerability by constructing a specially crafted PowerPoint file
     that could allow remote code execution.

Microsoft PowerPoint Malformed Record Vulnerability - CVE-2006-3449

     A remote code execution vulnerability exists in PowerPoint and could
     be exploited when a file containing a malformed record is parsed by
     PowerPoint.  Such a file might be included in an e-mail attachment
     or hosted on a malicious web site. An attacker could exploit the
     vulnerability by constructing a specially crafted PowerPoint file
     that could allow remote code execution.

     If a user were logged on with administrative user rights, an attacker
     who successfully exploited this vulnerability could take complete
     control of an affected system. An attacker could then install programs;
     view, change, or delete data; or create new accounts with full user
     rights. Users whose accounts are configured to have fewer user rights
     on the system could be less affected than users who operate with
     administrative user rights.

           =========================================================
           Les serveurs de référence du CERT-Renater
           http://www.urec.fr/securite
           http://www.cru.fr/securite
           http://www.renater.fr
           =========================================================
           + CERT-RENATER          | tel : 01-53-94-20-44          +
           + 151 bd de l'Hopital   | fax : 01-53-94-20-41          +
           + 75013 Paris           | email: certsvp@renater.fr     +
           =========================================================