MSO.DLL in Microsoft Office 2000, Office XP (2002), and Office 2003 allows user-assisted attackers to cause a denial of service and execute arbitrary code via multiple attack vectors, as originally demonstrated using a crafted document record with a malformed string, as demonstrated by replacing a certain "01 00 00 00" byte sequence with an "FF FF FF FF" byte sequence, possibly causing an invalid array index, in (1) an Excel .xls document, which triggers an access violation in ole32.dll; (2) an Excel .xlw document, which triggers an access violation in excel.exe; (3) a Word document, which triggers an access violation in mso.dll in winword.exe; and (4) a PowerPoint document, which triggers an access violation in powerpnt.txt. NOTE: after the initial disclosure, this issue was demonstrated by triggering an integer overflow using an inconsistent size for a Unicode "Sheet Name" string.

The remote host is running a version of Microsoft Office that could allow arbitrary code to be run on this host.

To succeed, the attacker would have to send a rogue file to a user of the remote computer and have him open it with Microsoft Office.

The remote host is running a version of Microsoft Office that is affected by various flaws that may allow arbitrary code to be run.

To succeed, the attacker would have to send a rogue file to a user of the remote computer and have it open it with Microsoft Excel or another Office application.

ID	Name	Product	Family	Severity
22032	MS06-038: Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (917284)	Nessus	Windows : Microsoft Bulletins	medium
22025	MS06-037 / MS06-038: Vulnerabilities in Microsoft Excel and Office Could Allow Remote Code Execution (917284 / 917285) (Mac OS X)	Nessus	MacOS X Local Security Checks	medium

Detections

Analytics

CVE-2006-1540

high

Tenable Plugins

medium

medium