COMMAND
office and its components
SYSTEMS AFFECTED
- Microsoft Converter Pack 2000 for Windows
- Microsoft Office 2000 for Windows with Multilanguage Pack
- Japanese, Korean, Chinese (Simplified and Traditional) versions of:
- Microsoft Word 97, 98 and 2000 for Windows, which is available as a standalone product or as part of:
- Office 97, Office 97 Powered by Word 98, Office 2000 for Windows
- Works Suite 2000 for Windows
- Microsoft PowerPoint 97 and 2000 for Windows, which is available as a standalone product or as part of:
- Office 97, Office 97 Powered by Word 98, Office 2000 for Windows
PROBLEM
Microsoft Office includes a conversion utility that converts
older Word documents to more recent formats. The conversion
utility for Word 5 documents in East Asian languages (Japanese,
Korean, Simplified Chinese and Traditional Chinese) has an
unchecked buffer. By using a hexadecimal editor to insert
specially-malformed information into a document, a malicious user
could cause Word to run code of his or her choice when the
document was opened using an affected version of the converter.
A Word 5 converter installs by default as part of Word and
PowerPoint, and can be installed at user behest as part of a
converter pack. However, the vulnerability affects only the East
Asian language versions of the converter, and only the Windows
versions of them. No other language versions of the converter are
affected, and no version of the converter for Macintosh is
affected.
SOLUTION
Patch availability:
- Word 97 or 98, PowerPoint 98:
- US: http://officeupdate.microsoft.com/downloaddetails/ww5pkg.htm
- Japan: http://officeupdate.microsoft.com/japan/downloaddetails/MalformedData-97.htm
- Korea: http://officeupdate.microsoft.com/korea/downloaddetails/MalformedData-97.htm
- China: http://officeupdate.microsoft.com/china/downloaddetails/MalformedData-97.htm
- Taiwan: http://officeupdate.microsoft.com/taiwan/downloaddetails/MalformedData-97.htm
- Hong Kong: http://officeupdate.microsoft.com/hk/downloaddetails/MalformedData-97.htm
- Converter Pack 2000; Office 2000 with Multilanguage Pack; Word 2000, PowerPoint 2000:
- US: http://officeupdate.microsoft.com/2000/downloaddetails/ww5pkg.htm
- Japan: http://officeupdate.microsoft.com/japan/downloaddetails/2000/MalformedData-2K.htm
- Korea: http://officeupdate.microsoft.com/korea/downloaddetails/2000/MalformedData-2K.htm
- China: http://officeupdate.microsoft.com/china/downloaddetails/2000/MalformedData-2K.htm
- Taiwan: http://officeupdate.microsoft.com/taiwan/downloaddetails/2000/MalformedData-2K.htm
- Hong Kong: http://officeupdate.microsoft.com/hk/downloaddetails/2000/MalformedData-2K.htm