Severity: Medium
8 April, 2008
Summary:
- This vulnerability affects: Microsoft Project and Visio
- How an attacker exploits it: By enticing one of your users into downloading and opening a malicious Project or Visio file
- Impact: The attacker can execute code on your user’s computer, potentially gaining complete control of it
- What to do: Deploy the appropriate Project and Visio patches immediately
Severity: Medium
8 April, 2008
Summary:
- This vulnerability affects: Microsoft Project and Visio
- How an attacker exploits it: By enticing one of your users into downloading and opening a malicious Project or Visio file
- Impact: The attacker can execute code on your user’s computer, potentially gaining complete control of it
- What to do: Deploy the appropriate Project and Visio patches immediately
Exposure:
Today, Microsoft released two security bulletins describing vulnerabilities found in Microsoft Project and Visio. Specifically, the vulnerabilities affect Project 2000, 2002, and 2003, as well as Visio 2002, 2003, and 2007.
The flaws differ technically, but the end result is always the same. By enticing one of your users into downloading and viewing a specially crafted Project or Visio file, an attacker can exploit these vulnerabilities to execute code on your user’s computer, inheriting that user’s level of privileges and permissions. If your user has local administrative privileges, the attacker gains full control of the victim’s machine.
The affected documents and extensions include:
- Microsoft Project files (.MPP)
- Visio Documents (.VSD)
- Autodesk Drawing eXchange Format (.DXF)
If you’d like to learn more about each individual flaw, drill into the “Vulnerability Details” section of the security bulletins listed below:
- MS08-018: Project Memory Validation Vulnerabilities. This bulletin describes an unspecified memory validation vulnerability in Project. By tricking one of your users into downloading and opening a maliciously crafted Project file, an attacker could exploit this flaw to execute code, potentially gaining complete control of that user’s computer.
Microsoft rating: Critical.
- MS08-019: Two Visio Document Vulnerabilities. Visio suffers from two vulnerabilities involving the way it handles certain Visio files. Though the flaws differ technically, they have the same impact. By enticing one of your users into opening a specially crafted .VSD or .DXF file, an attacker could exploit either flaw to execute code on that user’s computer, with the user’s privileges. If the user has local administrator privileges, the attacker gains control of the user’s computer.
Microsoft rating:Important.
Solution Path:
You should download, test, and deploy the appropriate patches as soon as possible.
For All WatchGuard Users:
While you can configure certain WatchGuard Firebox models to block Visio and Project files, some organizations need to allow them in order to conduct business. Therefore, the patches are your best recourse. Temporarily though, you may still want to block Visio and Project files until you are able to install Microsoft’s patches.
If you want to block Visio and Project files, follow the links below for instructions on using your Firebox proxies’ content blocking features to block .MPP, .VSD, and .DXF files by their file extensions:
- Firebox X Edge running 8.5
- Firebox III and X Core running WFS
- Firebox X Core and X Peak running Fireware Pro
Status:
Microsoft has released patches to fix these vulnerabilities.