SANS ISC: Microsoft Security Bulletin MS06-037

• SANS Site Network
  • Current Site
  • SANS Internet Storm Center
  • Other SANS Sites Help
  • Graduate Degree Programs
  • Security Training
  • Security Certification
  • Security Awareness Training
  • Penetration Testing
  • Industrial Control Systems
  • Cyber Defense Foundations
  • DFIR
  • Software Security
  • Government OnSite Training

SANS ISC InfoSec Forums

Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (917285)

Impact of Vulnerability: Remote Code Execution

Maximum Severity Rating: Critical

Recommendation: Customers should apply the update immediately

This Security Bulletin covers multiple CVE items as indicated below:

CVE-2006-1301 - Microsoft Excel Malformed SELECTION record vulnerability
CVE-2006-1302 ? Microsoft Excel Malformed SELECTION record vulnerability
CVE-2006-1304 ? Microsoft Excel Malformed COLINFO record vulnerability
CVE-2006-1306 ? Microsoft Excel Malformed OBJECT record vulnerability
CVE-2006-1308 ? Microsoft Excel Malformed FNGROUPCOUNT Value vulnerability
CVE-2006-1309 ? Microsoft Excel Malformed LABEL record vulnerability
CVE-2006-2388 ? Microsoft Excel Rebuilding vulnerability
CVE-2006-3059 ? Microsoft Excel Malformed file vulnerability

This update resolves several public, privately reported, and newly discovered vulnerabilities.  All of these state that a remote code execution vulnerability exists in Excel dealing with each of the identified items. The only workaround suggested and tested is to NOT open attachments from untrusted sources.  I guess that means, PATCH.

Microsoft states:

When using vulnerable versions of Office, if a user were logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of the client workstation. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.