-----BEGIN PGP SIGNED MESSAGE-----

===========================================================================
             AUSCERT External Security Bulletin Redistribution

           ESB-2003.0617 -- Microsoft Security Bulletin MS03-035
  Flaw in Microsoft Word Could Enable Macros to Run Automatically(827653)
                             04 September 2003

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:                Microsoft Word
                        Microsoft Works
Publisher:              Microsoft
Operating System:       Windows
Impact:                 Execute Arbitrary Code/Commands
Access Required:        Remote
CVE Names:              CAN-2003-0664

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----

- - -------------------------------------------------------------------
Title:     Flaw in Microsoft Word Could Enable Macros to Run 
           Automatically (827653)
Date:      September 3, 2003
Software:  Microsoft Word 97 
           Microsoft Word 98 (J) 
           Microsoft Word 2000 
           Microsoft Word 2002 
           Microsoft Works Suite 2001 
           Microsoft Works Suite 2002 
           Microsoft Works Suite 2003 
Impact:    Run macros without warning 
Max Risk:  Important
Bulletin:  MS03-035

Microsoft encourages customers to review the Security Bulletins at:
    
http://www.microsoft.com/technet/security/bulletin/MS03-035.asp 
http://www.microsoft.com/security/security_bulletins/MS03-035.asp

- - -------------------------------------------------------------------

Issue:
======
A macro is a series of commands and instructions that can be 
grouped together as a single command to accomplish a task 
automatically. Microsoft Word supports the use of macros to allow 
the automation of commonly performed tasks. Since macros are 
executable code it is possible to misuse them, so Microsoft Word 
has a security model designed to validate whether a macro should be 
allowed to execute depending on the level of macro security the 
user has chosen.

A vulnerability exists because it is possible for an attacker to 
craft a malicious document that will bypass the macro security 
model. If the document was opened, this flaw could allow a 
malicious macro embedded in the document to be executed 
automatically, regardless of the level at which macro security is 
set. The malicious macro could take the same actions that the user 
had permissions to carry out, such as adding, changing or deleting 
data or files, communicating with a web site or formatting the hard 
drive. 

The vulnerability could only be exploited by an attacker who 
persuaded a user to open a malicious document - there is no way for 
an attacker to force a malicious document to be opened.

Mitigating Factors:
====================
 - The user must open the malicious document for an attacker to be 
   successful. An attacker cannot force the document to be opened 
   automatically. 

 - The vulnerability cannot be exploited automatically through e- 
   mail. A user must open an attachment sent in e-mail for an e-
   mail borne attack to be successful. 

 - By default, Outlook 2002 block programmatic access to the 
   Address Book. In addition, Outlook 98 and 2000 block 
   programmatic access to the Outlook Address Book if the Outlook 
   Email Security Update has been installed. Customers who use any 
   of these products would not be at risk of propagating an e-mail 
   borne attack that attempted to exploit this vulnerability. 

 - The vulnerability only affects Microsoft Word - other members of  
   the Office product family are not affected. 

Risk Rating:
============
 -Important

Patch Availability:
===================
 - A patch is available to fix this vulnerability. Please read the 
   Security Bulletins at

  http://www.microsoft.com/technet/security/bulletin/MS03-035.asp 
  http://www.microsoft.com/security/security_bulletins/MS03-035.asp

   for information on obtaining this patch.

Acknowledgment:
===============
 - Jim Bassett of Practitioners Publishing Company 
(http://www.ppcnet.com)
- - -------------------------------------------------------------------

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS 
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS 
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES 
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO 
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR 
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, 
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF 
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE 
POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION 
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES 
SO THE FOREGOING LIMITATION MAY NOT APPLY.




- -----BEGIN PGP SIGNATURE-----
Version: PGP 8.0.2

iQEVAwUBP1UvR40ZSRQxA/UrAQE0jwf8Dzm8/NCPSiH+BP7ePKRl66a9rawIDdlu
V+52lARZNbRkBNU00U8ImEzilgfIbgj0HZkcb4GpaQLUsPbYSuyiyu9PrKn0i+/j
JTaZOg48YJYZzhFOq+drUAMmwMQAkD3xb9fCrSxqET4/K4/55qiJW5uyOlH9RZ3K
BS6fhpmrQhOHGRU1gxWDbnRwWZmaqqMCr4WlGJZKZRH3L6kXwEfoH77Xq/v8BiXC
y0a6YqMpmA/Jd3Dpx8ByQBMTEfr2eHmMR9WDBowCip4iQ+p/Qorn8q6JpVlm8mhr
G+fCshh3bCiniTX5cXt+9B4yVqnpYXHefB0Vt5mfi6/bavgbiqdt4A==
=ZJEd
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business 
                hours which are GMT+10:00 (AEST).  On call after hours 
                for member emergencies only.
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBP1bMWih9+71yA2DNAQFlwQQAiq+lrFEQmm/rFRLQGk4kv5DLbek6MqVG
k2ksi9CsOcXcg/WBktC1W/Um0+sCBkpt4WVeoZY3Yg2fSbF31X0FX1N5XEan+7zn
zoOBOKUnUySa7GZMpTHBLKkP/5ip8Dej4kd2n/tSaEYFwFjXxfgIAiRpaSnJV56K
op3MH1AKjMc=
=Rjg7
-----END PGP SIGNATURE-----