#VU1176 Remote code execution in Microsoft products - CVE-2006-3059

Vulnerability identifier: #VU1176

Vulnerability risk: Critical

CVSSv4.0: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red]

CVE-ID: CVE-2006-3059

CWE-ID: CWE-119

Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
Microsoft Excel for Mac
Client/Desktop applications / Office applications
Microsoft Excel
Client/Desktop applications / Office applications
Microsoft Office
Client/Desktop applications / Office applications
Microsoft Office for Mac
Client/Desktop applications / Office applications

Vendor: Microsoft

Description
The vulnerability allows a remote user to execute arbitrary code on the target system.

The weakness is due to a stack-based buffer overflow in the HrShellOpenWithMonikerDisplayName() function. By persuading the victim to open a specially crafted Excel file, a remote attacker can cause DoS conditions or execute arbitrary code via a long hyperlink.

Successful exploitation of the vulnerability results in denial of service or arbitrary code execution on the vulnerable system.

Note: this vulnerability was being actively exploited.

Mitigation
Microsoft Excel 2003 - https://www.microsoft.com/downloads/details.aspx?FamilyId=5788518C-0FB3-4381-BB42-BCA71A4FD646
Microsoft Excel Viewer 2003 - https://www.microsoft.com/downloads/details.aspx?FamilyId=779666AB-CCD1-47A1-8A5A-B288A5204369
Microsoft Excel 2002 - https://www.microsoft.com/downloads/details.aspx?FamilyId=0828F77F-BE33-4913-B68D-6A375D5FE130
Microsoft Excel 2000 - https://www.microsoft.com/downloads/details.aspx?FamilyId=D8A2AD6D-582C-4185-ADE1-671D2128D3EE
Microsoft Excel 2004 for Mac - https://www.microsoft.com/mac/
Microsoft Excel v. X for Mac - https://www.microsoft.com/mac/

Vulnerable software versions

Microsoft Excel for Mac: v.X - 2004

Microsoft Excel: 2000, 2002, 2003

Microsoft Office: XP, 2000 Service Pack 3, 2003

Microsoft Office for Mac: 2004

---

External links
https://technet.microsoft.com/en-us/library/security/ms06-037.aspx

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, a fully functional exploit for this vulnerability is available.