Overview
A buffer overflow vulnerability in the Microsoft Office WordPerfect 5.x Converter could allow a remote attacker to execute arbitrary code on a vulnerable system.
Description
The Microsoft Office WordPerfect 5.x Converter allows users to convert documents in WordPerfect format to Microsoft Word format. The way the converter validates the length of a parameter before passing it to its allocated buffer creates a buffer overflow vulnerability. By convincing a victim to open a specially crafted WordPerfect 5.x document using the WordPerfect 5.x Converter, a remote attacker could trigger a buffer overflow. According to the Microsoft Security Bulletin, the following software is affected:
Microsoft notes that Office 2003 Service Pack 1 is not affected by this vulnerability. |
Impact
By convincing a victim to open a specially crafted WordPerfect 5.x document, a remote attacker could execute arbitrary code with the privileges of the vulnerable process. |
Solution
Apply Patch |
|
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
- http://www.microsoft.com/technet/security/bulletin/MS04-027.mspx
- http://secunia.com/advisories/12529/
- http://www.securiteam.com/windowsntfocus/5RP0D1FE0A.html
- http://www.securitytracker.com/alerts/2004/Sep/1011249.html
- http://www.securitytracker.com/alerts/2004/Sep/1011250.html
- http://www.securitytracker.com/alerts/2004/Sep/1011251.html
- http://www.securitytracker.com/alerts/2004/Sep/1011252.html
Acknowledgements
This vulnerability was reported by Microsoft. Microsoft credits Peter Winter-Smith for discovering this vulnerability.
This document was written by Damon Morda based on information provided by Microsoft.
Other Information
| CVE IDs: | CVE-2004-0573 |
| Severity Metric: | 0.90 |
| Date Public: | 2004-09-14 |
| Date First Published: | 2004-09-15 |
| Date Last Updated: | 2004-09-17 13:42 UTC |
| Document Revision: | 18 |