Alert GCSA-07003 - Vulnerabilita' multiple in Microsoft Excel

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


******************************************************************

             Alert ID : GCSA-07003
                 Data : 10 Gennaio 2007
               Titolo : Vulnerabilita' multiple in Microsoft Excel (MS07-002)

******************************************************************


:: Descrizione del problema:

Sono state identificate cinque vulnerabilita' in Microsoft Excel, che 
potrebbero essere sfruttate da un attaccante per ottenere il controllo 
completo di un sistema vulnerabile:

- - Excel Malformed IMDATA Record Vulnerability (CVE-2007-0027)
- - Excel Malformed Record Vulnerability (CVE-2007-0028)
- - Excel Malformed String Vulnerability (CVE-2007-0029)
- - Excel Malformed Column Record Vulnerability (CVE-2007-0030)
- - Excel Malformed Palette Record Vulnerability (CVE-2007-0031)

Tali vulnerabilita' sono dovute ad errori di corruzione della memoria durante 
la gestione di documenti contenenti record e stringhe malformati, e potrebbero 
essere sfruttate per eseguire comandi arbitrari attraverso l'apertura da parte 
dell'utente di presentazioni appositamente predisposte.


:: Piattaforme interessate:

  Microsoft Office 2000 Service Pack 3
  Microsoft Excel 2000
  Microsoft Office XP Service Pack 3
  Microsoft Excel 2002
  Microsoft Office 2003 Service Pack 2
  Microsoft Excel 2003
  Microsoft Office Excel Viewer 2003
  Microsoft Works Suite:
  Microsoft Works Suite 2004
  Microsoft Works Suite 2005
  Microsoft Office 2004 per Mac
  Microsoft Office v. X per Mac


:: Impatto:

Esecuzione di comandi arbitrari da remoto.
Possibile ottenimento del completo controllo del sistema.


:: Soluzioni:

Applicare gli aggiornamenti rilasciati da Microsoft:

http://www.microsoft.com/technet/security/Bulletin/MS07-002.mspx (Inglese)
http://www.microsoft.com/italy/technet/security/bulletin/MS07-002.mspx (Italiano)


:: Riferimenti:

Microsoft Security Bulletin MS07-002 (Inglese):
http://www.microsoft.com/technet/security/Bulletin/MS07-002.mspx

Microsoft Security Bulletin MS07-002 (Italiano):
http://www.microsoft.com/italy/technet/security/bulletin/MS07-002.mspx

Mitre CVE:
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0027
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0028
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0029
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0030
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0031

FrSIRT:
http://www.frsirt.com/english/advisories/2007/0103

Secunia:
http://secunia.com/advisories/23676/

-----BEGIN PGP SIGNATURE-----

iQCVAwUBRaTBt/OB+SpikaiRAQIvZwP9EnM5LDDeF8ieDO5mQ+rxn/CkXsMJ553d
cYh+etIvUMlvkN1iQiDrUdLR6t/F9eRodh6FVb1BCfDBwzha7Hckr2Q28IEK+2Sd
a04G1QyYFLTvH8ZqS/XArwR5IHplVYOOvsEnuXFOI7kvu2T9lakiXop/kSYnuB3i
jMPxTbFrGjg=
=QeTf
-----END PGP SIGNATURE-----