---------------------------------------------------------------------- A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI has been released. The new version includes many new and advanced features, which makes it even easier to stay patched. Download and test it today: https://psi.secunia.com/ Read more about this new version: https://psi.secunia.com/?page=changelog ---------------------------------------------------------------------- TITLE: Microsoft Office Web Components Two Vulnerabilities SECUNIA ADVISORY ID: SA29328 VERIFY ADVISORY: http://secunia.com/advisories/29328/ CRITICAL: Highly critical IMPACT: System access WHERE: >From remote SOFTWARE: Microsoft Office 2000 http://secunia.com/product/24/ Microsoft Office XP http://secunia.com/product/23/ Microsoft Visual Studio .NET 2002 http://secunia.com/product/1087/ Microsoft Visual Studio .NET 2003 http://secunia.com/product/1086/ Microsoft BizTalk Server 2000 http://secunia.com/product/1505/ Microsoft BizTalk Server 2002 http://secunia.com/product/1506/ Microsoft Commerce Server 2000 http://secunia.com/product/1815/ Microsoft ISA Server 2000 http://secunia.com/product/44/ Microsoft Office Web Components 2000 http://secunia.com/product/8410/ DESCRIPTION: Two vulnerabilities have been reported in Microsoft Office Web Components, which can be exploited by malicious people to compromise a vulnerable system. 1) An error in the management of memory when parsing certain URLs can be exploited to corrupt memory. 2) An error in the management of memory when parsing a specially crafted execution command can be exploited to corrupt memory. Successful exploitation of the vulnerabilities may allow execution of arbitrary code when e.g. visiting a malicious website. SOLUTION: Apply patches. Microsoft Office 2000 SP3: http://www.microsoft.com/downloads/details.aspx?FamilyId=806c654a-35e3-4385-855a-4b803249bfcf Microsoft Office XP SP3: http://www.microsoft.com/downloads/details.aspx?FamilyId=f54d2a5e-c0ed-4f70-9746-38dd61c8e9d7 Visual Studio .NET 2002 SP1: http://www.microsoft.com/downloads/details.aspx?FamilyId=D71B23FA-A873-406D-BAD7-E38E565DEE39 Visual Studio .NET 2003 SP1: http://www.microsoft.com/downloads/details.aspx?FamilyId=2FE10CCD-40CB-4090-B83D-EAE3D4ECA174 Microsoft BizTalk Server 2000: http://www.microsoft.com/downloads/details.aspx?FamilyId=E0993E49C0A811D2973D00C04F79E4B3 Microsoft BizTalk Server 2002: http://www.microsoft.com/downloads/details.aspx?FamilyId=12B7D09A92AB4596996670799837D961 Microsoft Commerce Server 2000: http://www.microsoft.com/downloads/details.aspx?FamilyId=71DE76BA-B62C-4A7A-A78A-9317F5255B13 Internet Security and Acceleration Server 2000 SP2: http://www.microsoft.com/downloads/details.aspx?FamilyId=526D87BD-C3DA-412E-8765-C15987AE9B01 PROVIDED AND/OR DISCOVERED BY: 1) The vendor credits: * Chris Ries, VigilantMinds Inc. * Xiao Hui, NCNIPC. 2) The vendor credits Yuval Ben-Itzhak, Finjan. ORIGINAL ADVISORY: MS08-017 (KB933103): http://www.microsoft.com/technet/security/Bulletin/MS08-017.mspx ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------