-----BEGIN PGP SIGNED MESSAGE-----

===========================================================================
             AUSCERT External Security Bulletin Redistribution

           ESB-2002.059 -- Microsoft Security Bulletin MS02-002
      Malformed Network Request can cause Office v. X for Mac to Fail
                              7 February 2002

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:                Microsoft Office v. X for Mac
Vendor:                 Microsoft
Operating System:       Mac
Impact:                 Denial of Service
Access Required:        Remote

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----

- - ----------------------------------------------------------------------
Title:      Malformed Network Request can cause Office v. X for Mac
            to Fail
Date:       06 February 2002
Software:   Microsoft Office v. X for Mac
Impact:     Denial of Service
Max Risk:   Low
Bulletin:   MS02-002

Microsoft encourages customers to review the Security Bulletin at: 
http://www.microsoft.com/technet/security/bulletin/MS02-002.asp.
- - ----------------------------------------------------------------------

Issue:
======
Office v. X contains a network-aware anti-piracy mechanism that
detects multiple copies of Office using the same product identifier
(PID) running on the local network. This feature, called the Network
Product Identification (PID) Checker, announces Office's own unique
product ID and listens for other announcements at regular intervals.
If a duplicate PID is detected, Office shuts down. 

A security vulnerability results because of a flaw in the Network 
PID Checker. Specifically, the Network PID Checker doesn't correctly
handle a particular type of malformed announcement - receiving one
causes the Network PID Checker to fail. When the Network PID fails
like this, the Office v. X application will fail as well. If more
than one Office v. X application was running when the packet was
received, the first application launched during the session would
fail. An attacker could use this vulnerability to cause other users'
Office applications to fail, with the loss of any unsaved data.
An attacker could craft and send this packet to a victim's machine
directly, by using the machine's IP address. Or, he could send
this same directive to a broadcast and multicast domain and attack
all affected machines

Mitigating Factors:
====================
 - Corporate networks could be protected against Internet-based
   attacks by following standard firewalling practices
   (specifically, blocking ports 2222, those greater than 3000
   traffic). 
 - Best practices recommends blocking both multicast and broadcast
   packets at the perimeter firewall. 
 - At best, an attacker could cause the running Office application
   that was loaded first to fail. There is no opportunity for an
   attacker to create, delete, or modify Office data. 
 - Even a successful attack wouldn't have any effect on the overall
   system, other applications or any Office application beyond the
   first one loaded.

Risk Rating:
============
 - Internet systems: None
 - Intranet systems: None
 - Client systems: Low

Patch Availability:
===================
 - A patch is available to fix this vulnerability. Please read the 
   Security Bulletin at
   http://www.microsoft.com/technet/security/bulletin/ms02-002.asp
   for information on obtaining this patch.

Acknowledgment:
===============
 - Marty Schoch (mschoch@multicasttech.com)

- - ---------------------------------------------------------------------

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS 
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS
ALL 
WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE 
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
IN NO EVENT 
SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY
DAMAGES 
WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL,
LOSS OF 
BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR
ITS 
SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME
STATES DO 
NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL
OR 
INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.

- -----BEGIN PGP SIGNATURE-----
Version: PGP 7.1

iQEVAwUBPGHPlo0ZSRQxA/UrAQFRUAf9GlgN6ku4fUyz54F9Q+vQ1fg3GOMpY3bw
KYxmLho5ZH8Ohrc2zPbaI7mFFsDoeDPKWcw0OFl/q+b1aOFKVC5R8xMGSdUujqPE
8J0iOgITvdb5FEcBIOpXepLidhVgrKhQnmAn9x/UlhKQG9MBAtq7riX2og8LxL4L
FffrDwx29fPMZrkANdFhmcrOgCMnbRwsegNtwg7OuUkJgJEOU6wwNsuuWsXKBadu
3/tv2iw5xrcAdfKwhblr7W+qBlmrT8roBLpZikC9FMa+Lf8vk2vRcBH8Gb8TYhzm
N9VGE37WNjHJ6NgCzo2r90LxxD0ummtOCbbUDHC+oXQNgdVvEq0Spw==
=t3Jb
- -----END PGP SIGNATURE-----


- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content.  The decision to use any or all of this information is
the responsibility of each user or organisation, and should be done so in
accordance with site policies and procedures.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the original authors to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

	http://www.auscert.org.au/Information/advisories.html

If you believe that your system has been compromised, contact AusCERT or
your representative in FIRST (Forum of Incident Response and Security
Teams).

Internet Email: auscert@auscert.org.au
Facsimile:	(07) 3365 7031
Telephone:	(07) 3365 4417 (International: +61 7 3365 4417)
		AusCERT personnel answer during Queensland business hours
		which are GMT+10:00 (AEST).
		On call after hours for emergencies.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key

iQCVAwUBPGKGjyh9+71yA2DNAQHy2gP9EMwttl+AHyDiMBrfgLjwfmV6qNY0aRjd
nCfUL5XUx2RdBZYMYlZOlOcU4Y8BwM6CG0cH76FaLr8dCeex1p21Vmg7xL0IFhZh
njdFrwQkj3aeCWSlpVZx1kvi5vdVzk+lKr7zIyvaH9tch0MdTcLIWVA1nvuCdxGQ
pW4QSGCu/Dg=
=MgiG
-----END PGP SIGNATURE-----