-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
A  U  S  C  E  R  T                                           A  L  E  R  T

                       AL-2008.0119 -- AUSCERT ALERT
                                   [Win]
MS08-070 - Critical - Vulnerabilities in Visual Basic 6.0 Runtime Extended
        Files (ActiveX Controls) Could Allow Remote Code Execution
                             10 December 2008

===========================================================================

        AusCERT Alert Summary
        ---------------------

Product:              Microsoft Visual Basic 6.0 Runtime Extended Files	
                      Microsoft Visual Studio .NET 2002 Service Pack 1
                      Microsoft Visual Studio .NET 2003 Service Pack 1
                      Microsoft Visual FoxPro 8.0 Service Pack 1
                      Microsoft Visual FoxPro 9.0 Service Pack 1
                      Microsoft Visual FoxPro 9.0 Service Pack 2
                      Microsoft Office Software	
                      Microsoft Office FrontPage 2002 Service Pack 3*
                      Microsoft Office Project 2003 Service Pack 3
                      Microsoft Office Project 2007
                      Microsoft Office Project 2007 Service Pack 1
Publisher:            Microsoft
Operating System:     Windows
Impact:               Execute Arbitrary Code/Commands
Access:               Remote/Unauthenticated
CVE Names:            CVE-2008-3704 CVE-2008-4252 CVE-2008-4253
                      CVE-2008-4254 CVE-2008-4255 CVE-2008-4256

Original Bulletin:    
  http://www.microsoft.com/technet/security/Bulletin/ms08-070.mspx

- --------------------------BEGIN INCLUDED TEXT--------------------

Microsoft Security Bulletin MS08-070 - Critical
Vulnerabilities in Visual Basic 6.0 Runtime Extended Files (ActiveX Controls) 
Could Allow Remote Code Execution (932349)

   Published: December 9, 2008

   Version: 1.0

General Information

Executive Summary

   This security update resolves five privately reported vulnerabilities and 
   one publicly disclosed vulnerability in the ActiveX controls for the 
   Microsoft Visual Basic 6.0 Runtime Extended Files. These vulnerabilities 
   could allow remote code execution if a user browsed a Web site that contains 
   specially crafted content. Users whose accounts are configured to have fewer 
   user rights on the system could be less impacted than users who operate with 
   administrative user rights.

   This security update is rated Critical for supported components of the 
   Microsoft Visual Basic 6.0 Runtime Extended Files; all supported editions of 
   Microsoft Visual Studio .NET 2002, Microsoft Visual Studio .NET 2003, 
   Microsoft Visual FoxPro 8.0, Microsoft Visual FoxPro 9.0, Microsoft Office 
   Project 2003, Microsoft Office Project 2007; and the Chinese Simplified 
   (China), Chinese Pan (Hong Kong), Chinese Traditional (Taiwan), and Korean 
   versions of Microsoft Office FrontPage 2002. For more information, see the 
   subsection, Affected and Non-Affected Software, in this section.

   The security update addresses the vulnerabilities by improving validation 
   and error handling within the ActiveX controls. For more information about 
   the vulnerabilities, see the Frequently Asked Questions (FAQ) subsection for 
   the specific vulnerability entry under the next section, Vulnerability 
   Information.

   Recommendation. Microsoft recommends that customers apply the update 
   immediately.

   Known Issues. Microsoft Knowledge Base Article 932349 documents the 
   currently known issues that customers may experience when installing this 
   security update. The article also documents recommended solutions for these 
   issues.

Affected Software

   Microsoft Visual Basic 6.0 Runtime Extended Files	

   Microsoft Visual Studio .NET 2002 Service Pack 1

   Microsoft Visual Studio .NET 2003 Service Pack 1

   Microsoft Visual FoxPro 8.0 Service Pack 1

   Microsoft Visual FoxPro 9.0 Service Pack 1

   Microsoft Visual FoxPro 9.0 Service Pack 2

   Microsoft Office Software	 	 	 

   Microsoft Office FrontPage 2002 Service Pack 3*

   Microsoft Office Project 2003 Service Pack 3

   Microsoft Office Project 2007

   Microsoft Office Project 2007 Service Pack 1

   * This update only applies to FrontPage 2002 Service Pack 3 versions in 
   Chinese Simplified (China), Chinese Pan (Hong Kong), Chinese Traditional 
   (Taiwan), and Korean.

Vulnerability Information

DataGrid Control Memory Corruption Vulnerability - CVE-2008-4252

   A remote code execution vulnerability exists in the DataGrid ActiveX 
   Control for Visual Basic 6. An attacker could exploit the vulnerability 
   by constructing a specially crafted Web page. When a user views the Web 
   page, the vulnerability could allow remote code execution. An attacker 
   who successfully exploited this vulnerability could gain the same user 
   rights as the logged-on user.
	
FlexGrid Control Memory Corruption Vulnerability - CVE-2008-4253

   A remote code execution vulnerability exists in the FlexGrid ActiveX 
   Control for Visual Basic 6. An attacker could exploit the vulnerability 
   by constructing a specially crafted Web page. When a user views the Web 
   page, the vulnerability could allow remote code execution. An attacker 
   who successfully exploited this vulnerability could gain the same user 
   rights as the logged-on user.

Hierarchical FlexGrid Control Memory Corruption Vulnerability - CVE-2008-4254

   A remote code execution vulnerability exists in the Hierarchical FlexGrid 
   ActiveX Control for Visual Basic 6. An attacker could exploit the 
   vulnerability by constructing a specially crafted Web page. When a user 
   views the Web page, the vulnerability could allow remote code execution. 
   An attacker who successfully exploited this vulnerability could gain the 
   same user rights as the logged-on user.

Windows Common AVI Parsing Overflow Vulnerability - CVE-2008-4255

   A remote code execution vulnerability exists in the Windows Common ActiveX 
   Control for Visual Basic 6. An attacker could exploit the vulnerability by 
   constructing a specially crafted Web page. When a user views the Web page, 
   the vulnerability could allow remote code execution. An attacker who 
   successfully exploited this vulnerability could gain the same user rights 
   as the logged-on user.
	
Charts Control Memory Corruption Vulnerability - CVE-2008-4256

   A remote code execution vulnerability exists in the Charts ActiveX Control 
   for Visual Basic 6. An attacker could exploit the vulnerability by 
   constructing a specially crafted Web page. When a user views the Web page, 
   the vulnerability could allow remote code execution. An attacker who 
   successfully exploited this vulnerability could gain the same user rights 
   as the logged-on user.

Masked Edit Control Memory Corruption Vulnerability - CVE-2008-3704

   A remote code execution vulnerability exists in the Masked Edit ActiveX 
   Control for Visual Basic 6. An attacker could exploit the vulnerability by 
   constructing a specially crafted Web page. When a user views the Web page, 
   the vulnerability could allow remote code execution. An attacker who 
   successfully exploited this vulnerability could gain the same user rights 
   as the logged-on user.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBST8Siyh9+71yA2DNAQIo3gP/T5yxmtXlkXWwz2FchqAbnG5XdExsNnEj
A/V0agRw4IrsZ39+NMK4oEDKhB/WgsV9ver+NA5raStTylON+jdgjJN4f1Bjfjty
CwbQlNaHvrs0MkrH2WNfTxWjRwA718BLGkcqd4z67Wvn6fERqJTyOJiI8aKC8DSO
Gk0Pjbgj/o8=
=gAHo
-----END PGP SIGNATURE-----