Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
Производитель ПО
Наименование ПО
Microsoft Excel
(2000, 2000 SP3, 2002, 2002 SP3, 2003, 2003 SP2, 2004 for Mac, v. X for Mac)
Microsoft Excel Viewer
(2003 )
Microsoft Office
(WorkSuite 2004, WorkSuite 2005, WorkSuite 2006)
Microsoft Updates
(KB2264397, KB2264403, KB2344893, KB2345017, KB2466169, KB2502786, KB2541003, KB2541025, KB2553072, KB2596954, KB2597086, KB2687481, KB2810048, KB923088, KB923089, KB923090, KB923275, KB923618, KB924998, KB924999, KB925257, KB925523, KB925524, KB925525, KB933666, KB934445, KB934447, KB934453, KB934737, KB936507, KB936508, KB936511, KB936513, KB940596, KB940601, KB940602, KB940604, KB943889, KB943985, KB946976, KB946979, KB951548, KB951551, KB951582, KB951589, KB955461, KB955464, KB955466, KB955468, KB958372, KB958434, KB958435, KB958436, KB959964, KB959988, KB959993, KB959995, KB969680, KB969681, KB969683, KB969685, KB973471, KB973475, KB973484, KB978471, KB978474, KB982133, KB982299)
Описание
В Excel имеется уязвимость удаленного запуска кода. Злоумышленник может воспользоваться данной уязвимостью при анализе файла и обработке искаженной записи STYLE приложением Excel.
Как исправить
Используйте рекомендации производителя:
http://www.microsoft.com/technet/security/Bulletin/MS06-059.mspx
http://www.microsoft.com/technet/security/Bulletin/MS06-059.mspx
Ссылки
BUGTRAQ (20060703 Excel 2000/XP/2003 Style 0day POC): http://www.securityfocus.com/archive/1/archive/1/438963/100/0/threaded
BUGTRAQ (20060707 Major updates to Excel 0-day Vulnerability FAQ at SecuriTeam Blogs): http://www.securityfocus.com/archive/1/archive/1/439427/100/0/threaded
BID (18872): http://www.securityfocus.com/bid/18872
FRSIRT (ADV-2006-2689): http://www.frsirt.com/english/advisories/2006/2689
SECTRACK (1016430): http://securitytracker.com/id?1016430
BUGTRAQ (20060711 New CVE number states Excel Style handling as a separate issue): http://marc.theaimsgroup.com/?l=bugtraq&m=115274676314243&w=2
MS (MS06-059): http://www.microsoft.com/technet/security/Bulletin/MS06-059.mspx
HP (HPSBST02161): http://www.securityfocus.com/archive/1/archive/1/449179/100/0/threaded
OVAL (oval:org.mitre.oval:def:431): http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:431
BUGTRAQ (20060707 Major updates to Excel 0-day Vulnerability FAQ at SecuriTeam Blogs): http://www.securityfocus.com/archive/1/archive/1/439427/100/0/threaded
BID (18872): http://www.securityfocus.com/bid/18872
FRSIRT (ADV-2006-2689): http://www.frsirt.com/english/advisories/2006/2689
SECTRACK (1016430): http://securitytracker.com/id?1016430
BUGTRAQ (20060711 New CVE number states Excel Style handling as a separate issue): http://marc.theaimsgroup.com/?l=bugtraq&m=115274676314243&w=2
MS (MS06-059): http://www.microsoft.com/technet/security/Bulletin/MS06-059.mspx
HP (HPSBST02161): http://www.securityfocus.com/archive/1/archive/1/449179/100/0/threaded
OVAL (oval:org.mitre.oval:def:431): http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:431
