Class101

A remote code execution issue exists due to the parsing of a file with a malformed chart record by Office. This could be exploited by an attacker.

Name of the Vulnerable Software and Affected Versions: Microsoft Excel versions 2000 through 2003 Microsoft Office version 2000 SP3 Description: A remote code execution issue exists in Excel, related to the parsing of malformed file formats. This can be exploited by an attacker constructing a specially crafted Excel file, allowing for remote code execution. The issue involves memory corruption, probably due to invalid pointers, when parsing a BIFF format file containing malformed BOOLERR records. Recommendations: For Microsoft Excel versions 2000 through 2003, and Microsoft Office version 2000 SP3, consider disabling the parsing of BIFF format files until a patch is available. As a temporary workaround, restrict the use of Excel to open files from untrusted sources to minimize the risk of exploitation. Avoid using Excel to open specially crafted files that could contain malformed parsing format until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to multiple buffer overflows. These buffer overflows can be exploited by remote attackers to execute arbitrary code via a modified computer name and length that leads to a heap-based buffer overflow. Additionally, local users can execute arbitrary code via a long Name entry in the `configure.cfg` file.

Name of the Vulnerable Software and Affected Versions: Netcat for Windows version 1.1 Description: A stack-based buffer overflow issue exists when running with the -e option, allowing remote attackers to execute arbitrary code via a long DNS command. Recommendations: For Netcat for Windows version 1.1, avoid using the -e option until a patch is available. As a temporary workaround, consider restricting the use of the DNS command to minimize the risk of exploitation.