Buffer Overrun in WordPerfect Converter New

A security flaw exists in the WordPerfect converter included with the Microsoft Office and Works suites that could allow an attacker to run the code of their choice by persuading a user to open a malicious WordPerfect document.

Issue

Microsoft Office provides a number of converters that allow users to import and edit files that use formats that are not native to Office. These converters are available as part of the default installation of Office and are also available separately in the Microsoft Office Converter Pack. These converters can be useful to organizations that use Office in a mixed environment with earlier versions of Office and other applications, including Office for the Macintosh and third-party productivity applications.

There is a flaw in the way that the Microsoft WordPerfect converter handles Corel® WordPerfect documents. A security vulnerability results because the converter does not correctly validate certain parameters when it opens a WordPerfect document, which results in an unchecked buffer. As a result, an attacker could craft a malicious WordPerfect document that could allow code of their choice to be executed if an application that used the WordPerfect converter opened the document. Microsoft Word and Microsoft PowerPoint (which are part of the Office suite), FrontPage (which is available as part of the Office suite or separately), Publisher, and Microsoft Works Suite can all use the Microsoft Office WordPerfect converter.

The vulnerability could only be exploited by an attacker who persuaded a user to open a malicious WordPerfect document—there is no way for an attacker to force a malicious document to be opened or to trigger an attack automatically by sending an e-mail message.

Affected Products

• Microsoft Office 97
• Microsoft Office 2000
• Microsoft Office XP
• Microsoft Word 98 (J)
• Microsoft FrontPage 2000
• Microsoft FrontPage 2002
• Microsoft Publisher 2000
• Microsoft Publisher 2002
• Microsoft Works Suite 2001
• Microsoft Works Suite 2002
• Microsoft Works Suite 2003

Download

Patch: http://www.office.microsoft.com/ProductUpdates/default.aspx

Further Details

Source: Microsoft Corporation

Reference: Microsoft Corporation

Updated: September 3, 2003

>> Recommended Download - secure your PC from spyware, adware and malware now with Spyware Doctor <<