Multiple Vulnerabilities in Microsoft's Office Web Components ActiveX Control

Reported August 21, 2002, by Microsoft.

VERSIONS AFFECTED

 

·         Microsoft Office Web Components 2002 and 2000

 

Microsoft Products that include Office Web Components:

 

  • Microsoft Money 2002 and 2003

  • Microsoft BizTalk Server 2002 and 2000

  • Microsoft BackOffice Server 2000

  • Microsoft Commerce Server 2002 and 2000

  • Microsoft Internet Security and Acceleration Server 2000

  • Microsoft Office XP

  • Microsoft Project 2002

  • Microsoft Project Server 2002

  • Microsoft Small Business Server 2000

 

DESCRIPTION

 

Three vulnerabilities exist in the ActiveX control of Microsoft’s Office Web Components 2002 and 2000. These vulnerabilities result from problems in the following methods and functions included in the ActiveX control:

 

·         Host(). This function provides the caller with access to applications’ object models on the user’s system. By using the Host() function, an attacker can open an Office application on the vulnerable system and invoke commands under the user’s security context.

 

·         LoadText(). This method lets a Web page load text into a browser window. The method checks that the source of the text is in the same domain as the window and should restrict the page to loading only text that it hosts itself. An attacker can bypass this restriction by specifying a text source located within the Web page’s domain, and then setting up a server-side redirect of that text to a file on the user’s system. An attacker can then read any file on the vulnerable user’s system.

 

·         Copy()/Paste(). These methods let a user copy and paste text. A vulnerability stems from the fact that the method doesn't respect the “disallow paste via script” security setting in Microsoft Internet Explorer (IE). As a result, even if the user selects this security setting in IE, an attacker can use the Web page to continue to access the copy buffer and read any text that the vulnerable user had copied or cut from within other applications.

 

VENDOR RESPONSE

 

The vendor, Microsoft, has released Security Bulletin MS02-044 (Unsafe Functions in Office Web Components) to address these vulnerabilities and recommends that affected users download and apply the appropriate patch mentioned in the bulletin.

 

CREDIT
Discovered by Microsoft.

Hide comments

Comments

  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.
Publish