Re: @Stake Advisory: Microsoft Office 2000 ClipArt Vulnerablity

From: Weld Pond (weldat_private)
Date: Wed Mar 08 2000 - 06:13:05 PST

  • Next message: Vanja Hrustic: "[SAFER 000309.EXP.1.4] StarScheduler (StarOffice) vulnerabilities"

    On Tue, 7 Mar 2000, Dustin Miller wrote:
    
    > This bug does not seem to affect Windows Millennium Edition Build 2476,
    > oddly enough.  I do have Office 2000 Professional installed (retail
    > version), and CAG alarms with an error, but no key was created.
    
    
    >From the advisory:
    
      This is proof of concept code only, but theoretically could be any
      executable code desired. This code works only on Windows 2000, but
      shifting around a few offsets yields code that works under Windows NT
      4.0 and Win9X.
    
    
    Our proof of concept code will not give you a working test for the
    vulnerability on NT 4.0, 95, 98, mill. edition or even all versions of Win
    2000. Just because the key is not created don't think that you are not
    vulnerable. As far as we know all versions of Clip Art Gallery shipped
    with these products are effected: Office 2000, Home Publishing 2000, Works
    2000, Picture It! 2000, and PhotoDraw? 2000 Version 1.
    
    -weld
    



    This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:39:12 PDT