What's the scope of the vulnerability?
This is a buffer overrun vulnerability that could allow an attacker to run arbitrary code of their choice on a user's machine in the security context of that user, if the user were to open a specially malformed document.
What causes the vulnerability?
The vulnerability results because of a flaw in the way that Microsoft Visual Basic for Applications (VBA) checks certain document properties that are passed to it from a host application when a document is opened. As a result it is possible for the host application to pass unchecked parameters to Microsoft VBA, causing a buffer overrun condition that could allow arbitrary code to be executed.
What is Microsoft VBA?
Microsoft VBA is a development technology for developing client desktop packaged applications and integrating them with existing data and systems. VBA is based on the Microsoft Visual Basic development system. Visual Basic for Applications provides an integrated development environment (IDE) that features the same elements familiar to developers using Microsoft Visual Basic, including a Project Window, a Properties Window, and debugging tools. Microsoft VBA also includes support for Microsoft Forms, for creating custom dialog boxes, and ActiveX® Controls, for building user interfaces. VBA is integrated directly into a host application. Software programs that include VBA are called customizable applications-applications that can be tailored to fit specific business needs.
Microsoft Office is one of the many applications that incorporates Microsoft VBA, allowing customers to develop custom applications based on Microsoft Office. There are also other non-Microsoft applications that incorporate Microsoft VBA.
What's wrong with Microsoft VBA?
When a document is opened by an application that supports Microsoft VBA, the host application carries out a check to determine whether Microsoft VBA is required by the document and should therefore be loaded. During this initial check some document properties are passed to Microsoft VBA - a flaw exists because Microsoft VBA does not correctly validate the data that is passed to it during this initial phase.
Does this mean that Microsoft Office does not correctly check the security on a document?
No - the flaw is in a process that is initiated before any security checks occur. The flaw is in the initial check to determine whether Microsoft VBA is required by the host application in order to handle the document being opened. As a result, any security checks such as Macro protection checks, would not have not occurred when the vulnerability could be encountered.
What could this vulnerability enable an attacker to do?
This vulnerability could enable an attacker to execute code of their choice in the context of the logged on user.
How could an attacker exploit this vulnerability?
An attacker could seek to exploit this vulnerability by sending a user a specially crafted document designed to exploit this vulnerability, and encouraging the user to open the document. When the user opened the document it could cause arbitrary code to execute on the system in the security context of the logged on user. In the case where Microsoft Word is being used as the e-mail editor for Microsoft Outlook - which is the default setting for Office XP - an attacker could send a specially crafted e-mail to the user, and could cause arbitrary code to be executed if the user were to reply or forward the e-mail.
An attacker could also seek to exploit this vulnerability by creating a malicious document and hosting it on a webpage, and then enticing a user to visit the website. If the user were to visit the site and follow a link to the document, the document could open automatically, and therefore could allow arbitrary code to be run.
If I'm using Microsoft Word as my e-mail editor, can the vulnerability be exploited just through reading e-mail?
No - simply reading e-mail will not allow the vulnerability to be exploited. The user must reply to or forward the attacker's e-mail.
What does the patch do?
The patch eliminates the vulnerability by ensuring that Microsoft VBA carries out the appropriate checks on the data passed to it by a host application when a document is opened.
There are a number of patches available for this vulnerability? Which one should I install?
This depends on which version of Microsoft VBA and which host application you are using:
Microsoft VBA Patch:
If you are using any of the following applications, you should apply the Microsoft VBA Version of the patch:
- Microsoft VBA 5.0
- Microsoft VBA 6.0
- Microsoft VBA 6.2
- Microsoft VBA 6.3.
- Microsoft Access 97
- Microsoft Excel 97
- Microsoft PowerPoint 97
- Microsoft Word 97
- Microsoft Word 98(J)
- Microsoft Works 2001
- Microsoft Works 2002
- Microsoft Works Suite 2003
- Microsoft Business Solutions Great Plains 7.5
- Microsoft Business Solutions Dynamics 6.0
- Microsoft Business Solutions Dynamics 7.0
- Microsoft Business Solutions eEnterprise 6.0
- Microsoft Business Solutions eEnterprise 7.0
- Microsoft Business Solutions Solomon 4.5
- Microsoft Business Solutions Solomon 5.0
- Microsoft Business Solutions Solomon 5.5
Microsoft Project 2000, Microsoft Project 2002 and Microsoft Visio Patches:
If you are using Microsoft Project or Microsoft Visio you should apply the specific version of the patch for those products.
Microsoft Office 2000 and Microsoft Office XP patches:
If you are using Microsoft Office 2000 or Microsoft Office XP (including Publisher 2002) you should apply the specific version of the patch for those products.
I'm using more than one of the products listed above. Should I apply the product specific patch for each product?
Yes- you should patch each product that is listed above. For example, if you are using Microsoft Office XP and Microsoft Visio 2000, you should apply both the Microsoft Office XP and Microsoft Visio versions of the patch.
How do I tell which version of Microsoft VBA I am using?
To check if VBA is present on your system and to identify which version you are running check for the following files (where C:\ is your system drive):
- C:\Program Files\Common Files\Microsoft Shared\VBA\vbe.dll - if this file is present you have VBA 5.0.
- C:\Program Files\Common Files\Microsoft Shared\VBA\VBA6\vbe6.dll - if this file is present you have VBA 6.0.
I have a non-Microsoft application that makes use of Microsoft VBA. What should I do?
Microsoft has worked with 3rd parties who develop applications using Microsoft VBA to make sure they are aware of this security vulnerability and that they have the necessary updates to Microsoft VBA to incorporate in their products. You should contact your software vendor to obtain updates for any non-Microsoft applications that use Microsoft VBA.
