-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                          ESB-2007.0149 -- [Win]
Microsoft Windows Explorer fails to properly handle malformed OLE documents
                               8 March 2007

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              Windows Explorer
Publisher:            US-CERT
Operating System:     Windows
Impact:               Execute Arbitrary Code/Commands
                      Denial of Service
Access:               Remote/Unauthenticated

Original Bulletin:    http://www.kb.cert.org/vuls/id/194944

Comment: AusCERT will provide updated information when the impact
         of this vulnerability is confirmed.

- --------------------------BEGIN INCLUDED TEXT--------------------

US-CERT Vulnerability Note VU#194944
Microsoft Windows Explorer fails to properly handle malformed OLE documents

Overview

	Microsoft Windows Explorer fails to properly handle malformed Office
	documents. The complete impact of this vulnerability is not clear,
	but may include the execution of arbitrary code as well as crashing
	Windows Explorer.

I. Description

	Microsoft Office documents include summary information about the
	document, such as the line count in the document. Microsoft Windows
	Explorer can parse summary information in an Office document without
	having to open the document. A memory corruption vulnerability exists
	in a library Microsoft Windows Explorer uses to parse document summary
	information. This vulnerability can be triggered by accessing a
	specially crafted document, or by accessing the folder containing the
	document.

	Exploit code is available for this vulnerability.

II. Impact

	The complete impact of this vulnerability is not known. Memory
	corruption does occur, but it is not clear if this can be leveraged
	to execute arbitrary code. At a minimum, this vulnerability will cause
	Microsoft Windows Explorer to crash.

III. Solution

	We are currently unaware of a practical solution to this problem.
	Until a solution is available, the following workarounds may reduce
	the chances of exploitation:

	Do not access untrusted Office documents

	Do not access unfamiliar or unexpected Office documents, particularly
	those hosted on web sites or delivered as email attachments. Please
	see Cyber Security Tip ST04-010 for more information.
	http://www.us-cert.gov/cas/tips/ST04-010.html

	Do not rely on file name extension filtering

	In most cases, Windows will call Office to open a document even if
	the document has an unknown file extension. For example, if
	document.qwer contains the correct file header information, Windows
	will open document.qwer with the appropriate Office application.
	Filtering for common extensions (e.g., .doc, .xls, and .ppt) will not
	detect all Office documents.

Systems Affected

	Vendor                  Status      Date Updated
	Microsoft Corporation   Vulnerable  7-Mar-2007

References


Credit

	This vulnerability was publicly disclosed by Marsu.

	This document was written by Jeff Gennari.

Other Information

	Date Public	03/07/2007
	Date First Published	03/07/2007 12:17:25 PM
	Date Last Updated	03/07/2007
	CERT Advisory	 
	CVE Name	 
	Metric	22.05
	Document Revision	13

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBRe9T5Sh9+71yA2DNAQJSWAP5AXzNARtiPDi3Jj5jGiVx2pki8AQzfgvu
IcZXLIc2ujRap6QdPBvGO6emABkf8YBHjiIWqC7Xn7vW9pFMTYbJNxy/1orlUpUJ
aCxZiL1Xs4vBICbizMtfT4SqM0MlVstU077YXrfXFa8vmcxOBpqH0l1vbg3JGLrx
wEzfCBi1B7A=
=kcXF
-----END PGP SIGNATURE-----