Ethical Hacking Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package. | Computer Forensics Training at InfoSec Institute Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors. |

| Subject: | Shared section vulnerability when opening microsoft office document resulting in DoS |
|---|---|
| Date: | 27 Jul 2005 07:36:46 -0000 |
There is a shared section vulnerability in office products when trying to open an office document with firefox. For example try to open a word document attached in a webmail. firefox.exe process will create a son winword.exe process (it only appears when the process is created with firefox not svchosts). When creating this process a shared section is created called \BaseNameObjects\Mso97SharedDgXXXXXXXX (the number may change I am not sure at the present time). The rights on this shared section are put on "everyone" for delete/synchronise/query/modify. this allows to write arbitrary data and to perform a Dos against ALL Office open applications. I do not manage to know if it is a firefox or Microsoft office vulnerability
| <Prev in Thread] | Current Thread | [Next in Thread> |
|---|---|---|
| ||
| Previous by Date: | Re: Peter Gutmann data deletion theaory?, Jake Appelbaum |
|---|---|
| Next by Date: | Re: Peter Gutmann data deletion theaory?, Andreas Beck |
| Previous by Thread: | Re : [Firefox Bug 302187] New: Shared section vulnerability when opening microsoft office document resulting in DoS, sylvain . roger |
| Next by Thread: | FreeBSD Security Advisory FreeBSD-SA-05:18.zlib, FreeBSD Security Advisories |
| Indexes: | [Date] [Thread] [Top] [All Lists] |