Article
03/01/2023

Security Bulletin

Microsoft Security Bulletin MS03-050 - Important

Vulnerability in Microsoft Word and Microsoft Excel Could Allow Arbitrary Code to Run (831527)

Published: November 11, 2003 | Updated: February 13, 2004

Version: 1.1

Issued: November 11, 2003
Updated: February 13, 2004
Version: 1.1

See all Office bulletins released November, 2003

Summary

Who should read this document: Customers who are using Microsoft® Excel or Microsoft Word

Impact of vulnerability: Run code of attackers choice

Maximum Severity Rating: Important

Recommendation: Customers who are using the affected versions of Microsoft Excel or Microsoft Word should apply the appropriate security update at the earliest opportunity.

Security Update Replacement Excel: This patch replaces the security patches contained in the following bulletins: MS01-050, MS02-031 and MS02-059.

Security Update Replacement Word: This patch replaces the security patches contained in the following bulletins: MS02-021, MS02-031, MS02-059 and MS03-035.

Caveats: None

Tested Software and Security Update Download Locations:

Affected Software:

Microsoft Excel 97 - Download the update
Microsoft Excel 2000 - Download the update
Microsoft Excel 2002 - Download the update
Microsoft Word 97 - Download the update
Microsoft Word 98(J) - Download the update
Microsoft Word 2000 and Microsoft Works Suite 2001 - Download the update
Microsoft Word 2002, Microsoft Works Suite 2002, Microsoft Works Suite 2003, and Microsoft Works Suite 2004 - Download the update

Non Affected Software:

Microsoft Office Word 2003
Microsoft Office Excel 2003

The software listed above has been tested to determine if the versions are affected. Other versions are no longer supported, and may or may not be affected.

General Information

Technical Details

Technical description:

A security vulnerability exists in Microsoft Excel that could allow malicious code execution. This vulnerability exists because of the method Excel uses to check the spreadsheet before reading the macro instructions. If successfully exploited, an attacker could craft a malicious file that could bypass the macro security model. If an affected spreadsheet was opened, this vulnerability could allow a malicious macro embedded in the file to be executed automatically, regardless of the level at which the macro security is set. The malicious macro could then take the same actions that the user had permissions to carry out, such as adding, changing or deleting data or files, communicating with a web site or formatting the hard drive.

A security vulnerability exists in Microsoft Word that could allow malicious code execution. This vulnerability exists due to to the way Word checks the length of a data value (Macro names) embedded in a document. If a specially crafted document were to be opened it could overflow a data value in Word and allow arbitrary code to be executed. If successfully exploited, an attacker could then take the same actions as the user had permissions to carry out, such as adding, changing or deleting data or files, communicating with a web site or formatting the hard drive.

Mitigating factors:

If a user of Office 97 or Office 2000 has installed the Office Documentation Open Confirm Tool, the user will always get a "file open" warning dialog box when trying to open an Office document using Internet Explorer. For Office XP and Office System 2003 this "file open" warning dialog box is enabled by default.
These vulnerabilities could only be exploited by an attacker who persuaded a user to open a malicious file - there is no way for an attacker to force a user to open a malicious file.

Severity Rating:


Microsoft Excel 97	Important
Microsoft Excel 2000	Important
Microsoft Excel 2002	Important
Microsoft Word 97	Important
Microsoft Word 98(J)	Important
Microsoft Word 2000	Important
Microsoft Word 2002	Important
Microsoft Works Suite 2001	Important
Microsoft Works Suite 2002	Important
Microsoft Works Suite 2003	Important
Microsoft Works Suite 2004	Important

The above assessment is based on the types of systems affected by the vulnerability, their typical deployment patterns, and the effect that exploiting the vulnerability would have on them.

Vulnerability identifier Word: CAN-2003-0820

Vulnerability identifier Excel: CAN-2003-0821

Workarounds

Due to the fact that this vulnerability bypasses the built-in macro security, the best workaround if you are unable to deploy the update is to not open documents from un-trusted sources.

Frequently Asked Questions

What is a macro?
Generally, the term macro refers to a small program that automates frequently-performed tasks in an operating system or in a program. For example, many members of the Office family of products support the use of macros. This allows companies to develop macros that perform as sophisticated productivity tools that run in Word, in Excel, or in other programs. Like any computer program, macros can be misused. To combat this threat, Office has a security model that is designed to make sure that macros can only run when the user wants them to run.

What might an attacker use these vulnerabilities to do?
If successfully exploited, an attacker could cause code of their choice to run with additional privileges on the system. This could allow the attacker to add, delete or modify data on the system, or take any other action of the attacker's choice.

Who could exploit these vulnerabilities?
Any user who could entice another user to open a specially-crafted document can attempt to exploit these vulnerabilities.

How could an attacker exploit these vulnerabilities?
An attacker could seek to exploit either of these vulnerabilities by creating a specially-crafted document that contains malicious code. The attacker could then send this to a user, typically through an e-mail message, and then persuade the user to open the file. An attacker could also host the specially-crafted document on a network share or on a Web site; however, the attacker would still need to persuade the user to open the document.

Microsoft Works Suite is listed as a vulnerable product - why?
Microsoft Works Suite includes Microsoft Word. Microsoft Works users should use Office Update at: https://www.office.microsoft.com/ProductUpdates/default.aspx to detect and to install the appropriate update.

CAN-2003-0821: Excel Macro Vulnerability

What's the scope of the vulnerability in Microsoft Excel?
The Excel vulnerability could enable an attacker to create a spreadsheet that, when opened, could allow an XLM (Excel 4) macro to run regardless of the macro security level. Macros can take any action that the user can take, and as a result this vulnerability could allow an attacker to take actions such as changing data, communicating with Web sites, reformatting the hard disk, or changing the security settings in the application.

What causes the vulnerability in Microsoft Excel?
This vulnerability exists because of the method Excel uses to check the spreadsheet before reading the macro instructions. As a result the user will not be prompted with a macro security warning even when macros are present in the file.

What's wrong with the way Excel handles macro security?
Because of the way Excel reads and assesses macro security when a file is opened, under certain circumstances, macro security checks could be bypassed.

What does the update for Microsoft Excel do?
The update addresses the vulnerability by modifying the way that Excel performs macro security checks before opening a file.

CAN-2003-0820: Word Buffer Overrun Vulnerability

What's the scope of the vulnerability in Microsoft Word?
The Word buffer overrun vulnerability could enable an attacker to create a word document containing a Macro that, if successfully exploited, could allow an attacker to then take the same actions as the user had permissions to carry out - such as adding, changing or deleting data or files, communicating with a web site or formatting the hard drive.

What causes the vulnerability in Microsoft Word?
The vulnerability is the result of ithe way Word validates of the length of a data value (Macro names) embedded in a document. If successfully exploited an attacker could then take the same actions as the user had permissions to carry out-- such as adding, changing or deleting data or files, communicating with a web site or formatting the hard drive.

What's wrong with the way Word handles input buffers?
Because of the way Word validates the length of an input buffer, under certain circumstances, this validation could lead to a buffer overrun.

What does the update for Microsoft Word do?
The update corrects the buffer overrun by properly validating the input buffer before opening a file.

Security Update Information

For information about the specific security update for your platform, click the appropriate link:

For Microsoft Works Suite 2001 use the Word 2000 section
For Microsoft Works Suite 2002, 2003 and 2004 update use the Word 2002 section

Microsoft Excel 97

Prerequisites Client Update

This security update requires Office 97 Service Release 2

Inclusion in future service packs:

This update will be included in any future service packs for Office 97

Installation Information for the Client Update:

This security update supports the following Setup switches:

These switches do not work with all update files. If a switch does not work, the functionality is necessary for that package.

/q Specifies quiet mode, or suppresses prompts, when files are being extracted.

/q:u Specifies user-quiet mode, which presents some dialog boxes to the user.

/q:a Specifies administrator-quiet mode, which does not present any dialog boxes to the user.

/t:path Specifies the target folder for extracting files.

/c Extracts the files without installing them. If /t: path is not specified, you are prompted for a target folder.

/c:path Specifies the path and name of the Setup .inf or .exe file.

/r:n Never restarts the computer after installation.

/r:I Prompts the user to restart the computer if a restart is required, except when used with /q:a.

/r:a Always restarts the computer after installation.

/r:s Restarts the computer after installation without prompting the user.

/n:v No version checking - Install the program over any previous version.

Note: The use of the /n:v switch is unsupported and may result in an unbootable system. If the installation is unsuccessful, you should consult your support professional to understand why it fails.

For more information, see the Internet Explorer Administration Kit (IEAK).

Deployment Information

Download the Excel 97 Security Update
Click Save to save the Office97-KB830356-ENU.exe file to the selected folder.
In Windows Explorer, double-click Office97-KB830356-ENU.exe.
If you are prompted to install the update, click Yes.
Click Yes to accept the License Agreement.
Insert your Office 97 CD-ROM when you are prompted to do so, and then click OK.
When you receive a message that indicates the installation was successful, click OK.

Note: After you install the update, you cannot remove it. To revert to an installation before the update was installed, you must remove Office 97, and then install it again from the original CD-ROM.

Restart Requirement

No Restart required.

Removal Information

This security update can not be uninstalled

File Information

The English version of this update has the file attributes (or later) that are listed in the following table.

File name	Size	Date	File Version
Excel.exe	5,621,248	10/26/2003	8.0.1.9904
Scanload.dll	36,864	10/26/2003	8.2.0.9904

Verifying Update Installation

To determine the version of Excel that is installed on your computer, follow these steps.

Note: Because there are several versions of Microsoft Windows, the following steps may be different on your computer. If they are, see your product documentation to complete these steps.

Click Start, and then click Search.
In the Search Results pane, click All files and folders under Search Companion.
In the All or part of the file name box, type Excel.exe, and then click Search.
In the list of files, right-click Excel.exe, and then click Properties.
On the Version tab, determine the version of Excel that is installed on your computer.

Note: If the Excel 97 Security Update: KB830356 is already installed on your computer, you receive the following error message when you try to install the Excel 97 Security Update: KB830356:

This update has already been applied or is included in an update that has already been applied.

The update contains updated versions of the following files:

File name	Size	Date	File Version
Excel.exe	5,621,248	10/26/2003	8.00.01.9904

Microsoft Excel 2000

Prerequisites Client Update

Important: Before you install this update, make sure that the following requirements have been met:

Microsoft Windows Installer 2.0
Before you install this update, you must install Windows Installer 2.0 or later. For additional information about this requirement, see the "Windows Installer Update Requirements" section of this bulletin.
Office 2000 Service Pack 3 (SP-3)
Before you install this update, install Office 2000 SP-3. For additional information about how to install Office 2000 Service Pack 3, click the following article number to view the article in the Microsoft Knowledge Base:

326585 OFF2000: Overview of Office 2000 Service Pack 3

Inclusion in future service packs:

This update will be included in any future service packs for Office 2000

Installation Information client: