Microsoft Windows OLE Automation Remote Code Execution Vulnerability

Overview

» IDS/IPS Signatures

Security Sites

iPolicy Networks Security Advisory


Date Discovered:	02/12/2008
Severity:	High
Operating Systems Affected:	Microsoft Windows 2000 SP4 Microsoft Windows XP SP2 Microsoft Windows XP Professional x64 Microsoft Windows XP Professional x64 SP2 Microsoft Windows Server 2003 SP1 Microsoft Windows Server 2003 SP2 Microsoft Windows Server 2003 x64 Microsoft Windows Server 2003 x64 SP2 Windows Vista Windows Vista x64
Applications Affected:	Microsoft Office 2004 for Mac Microsoft Visual Basic 6.0 SP6

Synopsis

A remote code execution vulnerability exists in Object linking and Embedding (OLE) Automation that could allow an attacker who successfully exploited this vulnerability to make changes to the system with the permissions of the logged-on user.

Recommended Actions

Update the patches as guided by vendor at :
http://www.microsoft.com/technet/security/bulletin/ms08-008.mspx

Threat Analysis

Object linking and embedding (OLE) Automation is a Windows protocol that allows an application to share data or control another application. OLE Automation is an industry standard that applications use to expose their OLE objects to development tools, macro languages, and other containers that support OLE Automation.

Specially crafted script requests may cause memory corruption when using OLE Automation. An attacker who successfully exploited this vulnerability could make changes to the system with the permissions of the logged-on user. If a user is logged on with administrative user rights, an attacker could take complete control of the affected system. An attacker could then install programs, view, change, delete data or create new accounts with full user rights.

References

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0065

Write-up by: Aditya Chaturvedi

Security Sites

“iPolicy is one of the most visionary firewall vendors in the firewall Magic Quadrant. Its architecture of a central session processing engine and multiple content blades that are able to block based on signatures, rules and so on is the closest to the network security ideal.”

Greg Young, John Pescatore
Magic Quadrant for Network Firewalls, 2H04, Gartner

| | | | | | | | |