Unchecked Buffer in Internet Explorer and Office for Macintosh New

An unchecked buffer exists in Internet Explorer and Office applications for Macintosh. The vulnerability may allow an attacker to run the code of their choice on the system.

Issue

This is a cumulative patch that, when applied, eliminates all previously released security vulnerabilities affecting IE 5.1 for Macintosh, and Office v. X for Macintosh. In addition, it eliminates two newly discovered vulnerabilities.

• The first is a buffer overrun vulnerability associated with the handling of a particular HTML element. Because of support for HTML in Office applications, this flaw affects both IE and Office for Macintosh. A security vulnerability results because an attacker can levy a buffer overrun attack against IE that attempts to exploit this flaw. A successful attack would have the result of causing the program to fail, or to cause code of the attacker's choice to run as if it were the user.
• The second is a vulnerability that can allow local AppleScripts to be invoked by a web page. This vulnerability can allow locally stored AppleScripts to be invoked automatically without first calling the Helper application. The AppleScripts would run as if they had been launched by the user, and could take the same actions as any AppleScript legitimately launched by the user. The AppleScript would have to already be present on the system; there is no way for an attacker to deliver an AppleScript of her choosing through this vulnerability.

Affected Products

• Microsoft Internet Explorer 5.x and Office for Macintosh

Download

Patch: http://www.apple.com/macosx/upgrade/softwareupdates.html

Further Details

Source: Microsoft Corporation

Reference: Microsoft Corporation

Updated: April 16, 2002

>> Recommended Download - secure your PC from spyware, adware and malware now with Spyware Doctor <<