| VID |
26307 |
| Severity |
40 |
| Port |
139,445 |
| Protocol |
TCP |
| Class |
SMB |
| Detailed Description |
The hotfix (MS07-060, 942695) for 'Remote Code Execution Vulnerabilities in Microsoft Word' has not been applied. This update resolves newly discovered, public vulnerabilities in Microsoft Word that could allow an attacker to run arbitrary code on a user's system. Microsoft Word 2000 SP3, Word 2002 SP3, and Office 2004 for Mac could allow a remote attacker to execute arbitrary code, caused by improper handling of specially-crafted Word documents. By convincing a user to open a specially crafted Word document, an attacker could execute arbitrary code with the privileges of the user running Word. If the user is logged in with administrative privileges, the attacker could take complete control of a vulnerable system.
* Note: This check requires an account with administrative privileges which can log into the host to scan. Absence of these condition will result in the check not being performed and a False Negative for all vulnerable hosts.
* References:
http://www.microsoft.com/technet/security/bulletin/ms07-060.mspx
* Platforms Affected:
Microsoft Office 2004 for MacIntosh
Microsoft Word 2000 SP3
Microsoft Word 2002 SP3
Microsoft Windows Any version |
| Recommendation |
Apply the appropriate patch (942695) for your system, as listed in Microsoft Security Bulletin MS07-060 at http://www.microsoft.com/technet/security/bulletin/ms07-060.mspx |
| Related URL |
CVE-2007-0035,CVE-2007-0870,CVE-2007-1202 (CVE) |
| Related URL |
(SecurityFocus) |
| Related URL |
(ISS) |
|
