Reported August 21, 2002, by Microsoft.
VERSIONS AFFECTED
· Microsoft Office Web Components 2002 and 2000
Microsoft Products that include Office Web Components:
Microsoft Money 2002 and 2003
Microsoft BizTalk Server 2002 and 2000
Microsoft BackOffice Server 2000
Microsoft Commerce Server 2002 and 2000
Microsoft Internet Security and Acceleration Server 2000
Microsoft Office XP
Microsoft Project 2002
Microsoft Project Server 2002
Microsoft Small Business Server 2000
DESCRIPTION
Three vulnerabilities exist in the ActiveX control of Microsoft’s Office Web Components 2002 and 2000. These vulnerabilities result from problems in the following methods and functions included in the ActiveX control:
· Host(). This function provides the caller with access to applications’ object models on the user’s system. By using the Host() function, an attacker can open an Office application on the vulnerable system and invoke commands under the user’s security context.
· LoadText(). This method lets a Web page load text into a browser window. The method checks that the source of the text is in the same domain as the window and should restrict the page to loading only text that it hosts itself. An attacker can bypass this restriction by specifying a text source located within the Web page’s domain, and then setting up a server-side redirect of that text to a file on the user’s system. An attacker can then read any file on the vulnerable user’s system.
· Copy()/Paste(). These methods let a user copy and paste text. A vulnerability stems from the fact that the method doesn't respect the “disallow paste via script” security setting in Microsoft Internet Explorer (IE). As a result, even if the user selects this security setting in IE, an attacker can use the Web page to continue to access the copy buffer and read any text that the vulnerable user had copied or cut from within other applications.
VENDOR RESPONSE
The vendor, Microsoft, has released Security Bulletin MS02-044 (Unsafe Functions in Office Web Components) to address these vulnerabilities and recommends that affected users download and apply the appropriate patch mentioned in the bulletin.
CREDIT
Discovered by Microsoft.
