Microsoft Word and Outlook Object tag allows unauthorized access
| microsoft-object-gain-access (16663) |  High Risk |
Description:
Multiple could allow a remote attacker to gain unauthorized access to the system, caused by improper editing when Word is used to edit emails in Outlook. If a remote attacker creates a specially-crafted malicious email with an unclosed <OBJECT> tag and persuades the user to forward the email, the attacker could execute arbitrary code on the user's system, and possibly gain unauthorized access to the system. An attacker could exploit this vulnerability using malicious HTML documents, if the documents are edited in Microsoft Word.
Consequences:
Gain Access
Remedy:
No remedy available as of July 9, 2011.
References:
- BID-10683: Microsoft Word/Outlook Object Tag Security Setting Compromise Vulnerability
- CVE-2004-2482: Microsoft Outlook 2000 and 2003, when configured to use Microsoft Word 2000 or 2003 as the e-mail editor and when forwarding e-mail, does not properly handle an opening OBJECT tag that does not have a closing OBJECT tag, which causes Outlook to automatically download the URI in the data property of the OBJECT tag and might allow remote attackers to execute arbitrary code.
- SA12041: Microsoft Outlook / Word Object Tag Vulnerability
Platforms Affected:
- Microsoft Office 2000
- Microsoft Office 2003 Small Business
- Microsoft Office 2003 Standard
- Microsoft Office 2003 Professional
- Microsoft Office 2003 Student Teacher
- Microsoft Outlook 2000
- Microsoft Outlook 2003
- Microsoft Word 2000
- Microsoft Works 2003
Reported:
Jul 12, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net