Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
(AV:N/AC:H/Au:N/C:P/I:P/A:P)
Производитель ПО
Наименование ПО
Microsoft Excel
(2000, 2000 SP3, 2002, 2002 SP3, 2003, 2003 SP2, 2004 for Mac, v. X for Mac)
Microsoft Excel Viewer
(2003 )
Microsoft Updates
(KB2264397, KB2264403, KB2344893, KB2345017, KB2466169, KB2502786, KB2541003, KB2541025, KB2553072, KB2596954, KB2597086, KB2687481, KB2810048, KB918419, KB918420, KB918424, KB918425, KB921213, KB921214, KB923088, KB923089, KB923090, KB923275, KB925257, KB925523, KB925524, KB925525, KB933666, KB934445, KB934447, KB934453, KB936507, KB936511, KB936513, KB940596, KB940601, KB940602, KB943889, KB943985, KB946976, KB946979, KB951548, KB951551, KB951582, KB951589, KB955461, KB955464, KB955466, KB955468, KB958372, KB958434, KB958435, KB958436, KB959964, KB959988, KB959993, KB959995, KB969680, KB969681, KB969683, KB969685, KB973471, KB973475, KB973484, KB978471, KB978474, KB982133, KB982299)
Описание
В приложении Excel существует уязвимость удаленного выполнения кода из-за обработки искаженного файла. Злоумышленник может воспользоваться этой уязвимостью, создав специальный файл Excel, который делает возможным удаленный запуск кода.
Как исправить
Используйте рекомендации производителя:
http://www.microsoft.com/technet/security/Bulletin/MS06-037.mspx
http://www.microsoft.com/technet/security/Bulletin/MS06-037.mspx
Ссылки
http://blogs.technet.com/msrc/archive/2006/06/16/436174.aspx
CERT-VN (VU#802324): http://www.kb.cert.org/vuls/id/802324
BID (18422): http://www.securityfocus.com/bid/18422
FRSIRT (ADV-2006-2361): http://www.frsirt.com/english/advisories/2006/2361
SECTRACK (1016316): http://securitytracker.com/id?1016316
CERT (TA06-167A): http://www.us-cert.gov/cas/techalerts/TA06-167A.html
http://isc.sans.org/diary.php?storyid=1420
OSVDB (26527): http://www.osvdb.org/26527
XF (excel-unspecified-code-execution(27179)): http://xforce.iss.net/xforce/xfdb/27179
BUGTRAQ (20060618 Microsoft Excel 0-day Vulnerability FAQ document written): http://www.securityfocus.com/archive/1/archive/1/437636/100/0/threaded
http://blogs.securiteam.com/?p=451
BUGTRAQ (20060621 Excel 0-day FAQ updated with Microsoft advisory information): http://www.securityfocus.com/archive/1/archive/1/437936/100/0/threaded
CERT (TA06-192A): http://www.us-cert.gov/cas/techalerts/TA06-192A.html
MS (MS06-037): http://www.microsoft.com/technet/security/bulletin/ms06-037.mspx
FRSIRT (ADV-2006-2755): http://www.frsirt.com/english/advisories/2006/2755
OVAL (oval:org.mitre.oval:def:537): http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:537
CERT-VN (VU#802324): http://www.kb.cert.org/vuls/id/802324
BID (18422): http://www.securityfocus.com/bid/18422
FRSIRT (ADV-2006-2361): http://www.frsirt.com/english/advisories/2006/2361
SECTRACK (1016316): http://securitytracker.com/id?1016316
CERT (TA06-167A): http://www.us-cert.gov/cas/techalerts/TA06-167A.html
http://isc.sans.org/diary.php?storyid=1420
OSVDB (26527): http://www.osvdb.org/26527
XF (excel-unspecified-code-execution(27179)): http://xforce.iss.net/xforce/xfdb/27179
BUGTRAQ (20060618 Microsoft Excel 0-day Vulnerability FAQ document written): http://www.securityfocus.com/archive/1/archive/1/437636/100/0/threaded
http://blogs.securiteam.com/?p=451
BUGTRAQ (20060621 Excel 0-day FAQ updated with Microsoft advisory information): http://www.securityfocus.com/archive/1/archive/1/437936/100/0/threaded
CERT (TA06-192A): http://www.us-cert.gov/cas/techalerts/TA06-192A.html
MS (MS06-037): http://www.microsoft.com/technet/security/bulletin/ms06-037.mspx
FRSIRT (ADV-2006-2755): http://www.frsirt.com/english/advisories/2006/2755
OVAL (oval:org.mitre.oval:def:537): http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:537
