SANS ISC: Microsoft Security Bulletin MS06-038 - SANS Internet Storm Center

• SANS Site Network
  • Current Site
  • Internet Storm Center
  • Other SANS Sites Help
  • Graduate Degree Programs
  • Security Training
  • Security Certification
  • Security Awareness Training
  • Penetration Testing
  • Industrial Control Systems
  • Cyber Defense Foundations
  • DFIR
  • Software Security
  • Government OnSite Training

SANS ISC InfoSec Forums

It appears that all of the Microsoft Office 2000, 2002, 2003 programs are affected. Not affected is Works applications.

Summary

This is another remote code execution problem and appears to impact Office 2000 applications the worse lending to a critical assessment.  The other versions of Office identified as vulnerable are listed as important for all three of the CVE?s. 

From Microsoft Bulletin

A remote code execution vulnerability exists in Office, and could be exploited when a malformed string included in an Office file was parsed by any of the affected Office applications.  Such a string might be included in an email attachment processed by one of the affected applications or hosted on a malicious web site.  Viewing or previewing a malformed email message in an affected version of Outlook could not lead to exploitation of this vulnerability.  An attacker could exploit the vulnerability by constructing a specially crafted Office file that could allow remote code execution.

In all three cases the only tested work around is NOT to open attachments from untrusted sources.  I guess that means to apply the patch ASAP.