[mso] Another one, folks - FW: Microsoft Security Bulletin MS03-035: Flaw in Microsoft Word Could Enable Macros to Run Automatically(827653)

  • From: "Greg Chapman" <greg@xxxxxxxxxxxxx>
  • To: <mso@xxxxxxxxxxxxx>
  • Date: Wed, 3 Sep 2003 18:59:37 -0500

And, as I understand it, there are 3 more alerts released today. I won't
forward those to you but it would be a good idea to get up to MS and start
patching!

Greg Chapman
http://www.mousetrax.com
"Counting in binary is as easy as 01, 10, 11!
With thinking this clear, is coding really a good idea?"


-----Original Message-----
From: Microsoft
[mailto:0_51912_7615CB6F-616C-D111-9D3F-0000F84121EB_US@xxxxxxxxxxxxxxxxxx
oft.com]
Sent: Wednesday, September 03, 2003 7:54 PM
To: greg@xxxxxxxxxxxxx
Subject: Microsoft Security Bulletin MS03-035: Flaw in Microsoft Word
Could Enable Macros to Run Automatically(827653)


-----BEGIN PGP SIGNED MESSAGE-----

- -------------------------------------------------------------------
Title:     Flaw in Microsoft Word Could Enable Macros to Run
           Automatically (827653)
Date:      September 3, 2003
Software:  Microsoft Word 97
           Microsoft Word 98 (J)
           Microsoft Word 2000
           Microsoft Word 2002
           Microsoft Works Suite 2001
           Microsoft Works Suite 2002
           Microsoft Works Suite 2003
Impact:    Run macros without warning
Max Risk:  Important
Bulletin:  MS03-035

Microsoft encourages customers to review the Security Bulletins at:

http://www.microsoft.com/technet/security/bulletin/MS03-035.asp
http://www.microsoft.com/security/security_bulletins/MS03-035.asp

- -------------------------------------------------------------------

Issue:
======
A macro is a series of commands and instructions that can be
grouped together as a single command to accomplish a task
automatically. Microsoft Word supports the use of macros to allow
the automation of commonly performed tasks. Since macros are
executable code it is possible to misuse them, so Microsoft Word
has a security model designed to validate whether a macro should be
allowed to execute depending on the level of macro security the
user has chosen.

A vulnerability exists because it is possible for an attacker to
craft a malicious document that will bypass the macro security
model. If the document was opened, this flaw could allow a
malicious macro embedded in the document to be executed
automatically, regardless of the level at which macro security is
set. The malicious macro could take the same actions that the user
had permissions to carry out, such as adding, changing or deleting
data or files, communicating with a web site or formatting the hard
drive.

The vulnerability could only be exploited by an attacker who
persuaded a user to open a malicious document - there is no way for
an attacker to force a malicious document to be opened.

Mitigating Factors:
====================
 - The user must open the malicious document for an attacker to be
   successful. An attacker cannot force the document to be opened
   automatically.

 - The vulnerability cannot be exploited automatically through e-
   mail. A user must open an attachment sent in e-mail for an e-
   mail borne attack to be successful.

 - By default, Outlook 2002 block programmatic access to the
   Address Book. In addition, Outlook 98 and 2000 block
   programmatic access to the Outlook Address Book if the Outlook
   Email Security Update has been installed. Customers who use any
   of these products would not be at risk of propagating an e-mail
   borne attack that attempted to exploit this vulnerability.

 - The vulnerability only affects Microsoft Word - other members of
   the Office product family are not affected.

Risk Rating:
============
 -Important

Patch Availability:
===================
 - A patch is available to fix this vulnerability. Please read the
   Security Bulletins at

  http://www.microsoft.com/technet/security/bulletin/MS03-035.asp
  http://www.microsoft.com/security/security_bulletins/MS03-035.asp

   for information on obtaining this patch.

Acknowledgment:
===============
 - Jim Bassett of Practitioners Publishing Company
(http://www.ppcnet.com)
- -------------------------------------------------------------------

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.




-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0.2

iQEVAwUBP1UvR40ZSRQxA/UrAQE0jwf8Dzm8/NCPSiH+BP7ePKRl66a9rawIDdlu
V+52lARZNbRkBNU00U8ImEzilgfIbgj0HZkcb4GpaQLUsPbYSuyiyu9PrKn0i+/j
JTaZOg48YJYZzhFOq+drUAMmwMQAkD3xb9fCrSxqET4/K4/55qiJW5uyOlH9RZ3K
BS6fhpmrQhOHGRU1gxWDbnRwWZmaqqMCr4WlGJZKZRH3L6kXwEfoH77Xq/v8BiXC
y0a6YqMpmA/Jd3Dpx8ByQBMTEfr2eHmMR9WDBowCip4iQ+p/Qorn8q6JpVlm8mhr
G+fCshh3bCiniTX5cXt+9B4yVqnpYXHefB0Vt5mfi6/bavgbiqdt4A==
=ZJEd
-----END PGP SIGNATURE-----



*******************************************************************

You have received this e-mail bulletin because of your subscription to the
Microsoft Product Security Notification Service.  For more information on
this service, please visit
http://www.microsoft.com/technet/security/notify.asp.

To verify the digital signature on this bulletin, please download our PGP
key at http://www.microsoft.com/technet/security/notify.asp.

To unsubscribe from the Microsoft Security Notification Service, please
visit the Microsoft Profile Center at
http://register.microsoft.com/regsys/pic.asp

If you do not wish to use Microsoft Passport, you can unsubscribe from the
Microsoft Security Notification Service via email as described below:
Reply to this message with the word UNSUBSCRIBE in the Subject line.

For security-related information about Microsoft products, please visit
the Microsoft Security Advisor web site at
http://www.microsoft.com/security.


*************************************************************
You are receiving this mail because you subscribed to mso@xxxxxxxxxxxxx or 
MicrosoftOffice@xxxxxxxxxxxxxxxx

To send mail to the group, simply address it to mso@xxxxxxxxxxxxx

To Unsubscribe from this group, send an email to 
mso-request@xxxxxxxxxxxxx with the word "unsubscribe" (without the quotes) in 
the subject line.

Or, visit the group's homepage and use the dropdown menu.  This will also allow 
you to change your email settings to digest or vacation (no mail).
//www.freelists.org/webpage/mso

To be able to use the files section for sharing files with the group, send a 
request to mso-moderators@xxxxxxxxxxxxx and you will be sent an invitation with 
instructions.  Once you are a member of the files group, you can go here to 
upload/download files:
http://www.smartgroups.com/vault/msofiles
*************************************************************

Other related posts:

  • » [mso] Another one, folks - FW: Microsoft Security Bulletin MS03-035: Flaw in Microsoft Word Could Enable Macros to Run Automatically(827653)