Security Intelligence Operations

Microsoft Object Linking and Embedding (OLE) automation protocol contains a vulnerability that can allow an unauthenticated, remote attacker to execute arbitrary code with the privileges of the user.

This vulnerability exists due to insufficient sanitization of user-supplied input utilized within script code that leverages Windows OLE Automation. An unauthenticated, remote attacker could exploit this vulnerability by causing a malicious OLE request to be made on an affected system, likely by convincing a user to accept a malicious file or browse to a malicious website. When such a script is executed by the script interrupter, an error condition may occur that could allow the attacker to execute arbitrary code with the privileges of the currently logged on user.

Microsoft has confirmed the vulnerability in a security bulletin and released software updates.

The following Microsoft products are vulnerable:

Microsoft Windows 2000 SP4 and prior
Microsoft Windows XP SP2 and prior
Microsoft Windows XP x64
Microsoft Windows XP x64 SP2
Microsoft Windows Server 2003 SP2 and prior
Microsoft Windows Server 2003 x64
Microsoft Windows Server 2003 x64 SP2
Microsoft Windows Server 2003 for Itanium-based Systems SP2 and prior
Microsoft Office 2004 for Mac
Microsoft Visual Basic 6.0 SP6 and prior

Attackers rely on user interaction to exploit this vulnerability. An attacker could deliver a malicious script as an e-mail attachment, by convincing a user to visit a website hosting a malicious web page, embedding the script within stand-alone applications, or possibly by embedding the script within other document types, such as Microsoft Office documents. When a user opens any of these document types or applications on an affected system, the script may cause the execution of arbitrary code with the privileges of the user who invoked the application. On systems that grant users Administrator privileges, an exploit may result in the complete compromise of the affected system.

Microsoft has corrected the vulnerability by adding memory validation within the OLE automation protocol.

Microsoft has released a security bulletin at the following link: MS07-043