|
|
|
|
| |
Credit:
The information has been provided by Xin Ouyang.
|
| |
Vulnerable Systems:
* Microsoft Office 2000 Service Pack 3
* Microsoft Office XP Service Pack 3
* Microsoft Office 2003 Service Pack 1 or Service Pack 2
* Microsoft Works Suites
* Microsoft Office X for Mac
* Microsoft Office 2004 for Mac
A remote code execution vulnerability exists in Excel using a FNGROUPCOUNT value. An attacker could exploit the vulnerability by constructing a specially crafted Excel file that could allow remote code execution.
The vulnerable code is similar to MS06-012(CVE-2006-0031) :
eax=0e0e0e0e ebx=0000fff1 ecx=00002241 edx=0000000f esi=00138964
edi=0013ffff
eip=30093040 esp=0013794c ebp=001388e4 iopl=0 nv up ei pl nz na
po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00010206
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for Excel.EXE -
Excel!Ordinal41+0x93040:
30093040 f3ab rep stosd
es:0013ffff=74634100
Excel!Ordinal41+0x9302e:
3009302e 5c pop esp
3009302f f3ffff rep ???
30093032 8bd9 mov ebx,ecx
30093034 c1e902 shr ecx,0x2
30093037 8d7c1520 lea edi,[ebp+edx+0x20]
3009303b b80e0e0e0e mov eax,0xe0e0e0e
30093040 f3ab rep stosd
> 0:000> g
> (b98.5fc): Access violation - code c0000005 (first chance) First
> chance exceptions are reported before any exception handling.
> This exception may be expected and handled.
> eax=00000000 ebx=00000000 ecx=0e0e0e0e edx=7c9037d8 esi=00000000
> edi=00000000
> eip=0e0e0e0e esp=0013757c ebp=0013759c iopl=0 nv up ei pl zr na
> po nc
> cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
> efl=00010246
> 0e0e0e0e ?? ???
CVE Information:
CVE-2006-1308
|
|
|
|
|
