NEWS CATEGORIES:

NEWS ARCHIVE >>
SOFTPEDIA REVIEWS >>

Home / News / Microsoft

Microsoft

PowerPoint Crashing Bug Not a Security Vulnerability The flaw has received a non-critical rating	By Marius Oiaga, Technology News Editor 13th of November 2006, 11:57 GMT Adjust text size:


The Redmond Company and the Microsoft Security Response Center partners have rounded up an investigation related to publicly published proof of concept code impacting Microsoft Office 2003 PowerPoint. Although initially rated as a Critical vulnerability because it allowed for remote code execution in the eventuality of a successful exploit, its level was lowered to not critical as it only permits DoS attacks. "The short story is that this issue turned out to not be exploitable for remote code execution. It was a PowerPoint crashing bug not a PowerPoint security vulnerability. The PowerPoint team has developed a fix for this bug and it will go into the next available ship vehicle for PowerPoint," stated the SWI team a MSRC partner. "The bug is caused due to a NULL pointer dereference error when processing a PowerPoint presentation containing a container object with an invalid "position" value that is larger than the container's record length," stated Secunia. To parse a malformed PPT file generated by the perl script, PowerPoint attempts to identify a node in a list for a position out of the list's bounds. "The function that should be returning a legitimate object for later use by PowerPoint instead returns NULL due to the out-of-bounds position value. This return value is not checked for a NULL value before the address is operated on as an object. The reference of this NULL object pointer is what causes the exception," added the SWI team.

Rating:

Good (3.2/5)

5 vote(s) so far

Read by 881 user(s) | Add comment | Link to this article

Subscribe to news |

Print article |

Send to friend

© Copyright 2001-2008 Softpedia
Contact:

SEARCH THE NEWS ARCHIVE :

Today's News | Yesterday's News | News Archive

MORE RELATED ARTICLES:

IE7 - First Day - First Vulnerability

Microsoft Denies Internet Explorer 7 Vulnerability

Microsoft Has Updated IE7 Quick Reference Sheet

Microsoft to Debut Automatic Update Distribution of IE7 by November 1

IE7 High Assurance

Windows Search Guide in Internet Explorer 7

IE7 - Three Million Downloads in the First Four Days

What Is Microsoft Centro?

Microsoft Confirms Second IE7 Vulnerability

Internet Explorer 7 Kills Outlook Hotmail Integration

Firefox 2.0 - 2 Million Downloads on the First Day

IE7 and Firefox 2.0 Share Vulnerabilities

Windows Zero Day Attack Disables Firewall

Microsoft Is Investigating a Visual Studio 2005 Vulnerability

Six Security Bulletins from Microsoft

User opinions:

No user comments yet.

Be the first to express your opinion using the form below!

Share your opinion:

SUBMIT PROGRAM \| ADVERTISE \| GET HELP \| SEND US FEEDBACK \| RSS FEEDS \| ENTER NEWS SITE \| ENGLISH BOARD \| ROMANIAN FORUM
© 2001 - 2008 Softpedia. All rights reserved. Softpedia™ and the Softpedia™ logo are registered trademarks of SoftNews NET SRL.	Copyright Information \| Privacy Policy \| Terms of Use \| Update your software \| Archive