Microsoft Office HTML Object Tag Vulnerability

A security vulnerability exists in Microsoft Office 2000 programs which could allow a Hypertext Markup Language (HTML) file that contains a Data object tag to crash a Microsoft Office 2000 program and potentially run arbitrary or malicious code.

Issue

Microsoft Office 2000 applications are capable of reading HTML files saved as Office documents. A malformed data object tag embedded in one of these documents could cause the Office application to crash and allow arbitrary code to be executed.

In order for this behavior to occur, a malicious user would need to entice a user into opening the malformed Office document. Word 2000 users can protect themselves from opening malformed HTML documents within Word by enabling "Confirm conversion at Open" from the Tools-Options-General tab. In addition, Outlook users who have applied the Outlook Security Update will be prompted before opening web hosted or mail-borne Office documents.

Affected Products

• Microsoft Word 2000, Excel 2000, PowerPoint 2000

Download

Patch: http://officeupdate.microsoft.com/2000/downloadDetails/Of9data.htm

Further Details

Source: Microsoft Corporation

Reference: Microsoft Corporation

Updated: August 10, 2000

>> Recommended Download - secure your PC from spyware, adware and malware now with Spyware Doctor <<