Microsoft Security Bulletin MS05-012
Vulnerability in OLE and COM Could Allow Remote Code Execution (873333)

Issued: February 8, 2005
Version: 1.0
Summary

Who should read this document: Customers who use Microsoft Windows, Microsoft Exchange Server, Microsoft Office, or other third party applications that use OLE.

Impact of Vulnerability: Remote Code Execution

Maximum Severity Rating: Critical

Recommendation: Customers should apply the update immediately

Security Update Replacement: This bulletin replaces several prior security updates. See the frequently asked questions (FAQ) section of this bulletin for the complete list.

Caveats: Microsoft Knowledge Base Article 873333 documents the currently known issues that customers may experience when they install this security update. The article also documents recommended solutions for these issues. For more information, see Microsoft Knowledge Base Article 873333

Tested Software and Security Update Download Locations:

Affected Software:
?Microsoft Windows 2000 Service Pack 3 and Microsoft Windows 2000 Service Pack 4 ? Download the update
?Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2 ? Download the update
?Microsoft Windows XP 64-Bit Edition Service Pack 1 (Itanium) ? Download the update
?Microsoft Windows XP 64-Bit Edition Version 2003 (Itanium) ? Download the update
?Microsoft Windows Server 2003 ? Download the update
?Microsoft Windows Server 2003 for Itanium-based Systems? Download the update
?Microsoft Exchange 2000 Server Service Pack 3 (uses the Windows OLE component)
?Microsoft Exchange Server 2003 and Microsoft Exchange Server 2003 Service Pack 1 (uses the Windows OLE component)
?Microsoft Exchange Server 5.0 Service Pack 2 (uses the Windows OLE component)
?Microsoft Exchange Server 5.5 Service Pack 4 (uses the Windows OLE component)
?Microsoft Windows 98, Microsoft Windows 98 Second Edition (SE), and Microsoft Windows Millennium Edition (ME) ? Review the FAQ section of this bulletin for details about these operating systems.
?Microsoft Office XP Service Pack 3 (uses the Windows OLE component)

Microsoft Office XP Service Pack 2 (uses the Windows OLE component)

Microsoft Office XP Software:
?Outlook? 2002
?Word 2002
?Excel 2002
?PowerPoint? 2002
?FrontPage? 2002
?Publisher 2002
?Access 2002
?Microsoft Office 2003 Service Pack 1 (Uses the Windows OLE component)

Microsoft Office 2003 (Uses the Windows OLE component)

Microsoft Office 2003 Software:
?Outlook? 2003
?Word 2003
?Excel 2003
?PowerPoint? 2003
?FrontPage? 2003
?Publisher 2003
?Access 2003
?InfoPath? 2003
?OneNote? 2003

Note Any application that uses the Windows OLE component could also be vulnerable to this issue. This list of affected software documents the most likely attack vectors. We recommend customers install this security update immediately. Installing this security update will address this vulnerability in any application that uses the Windows OLE component.

The software in this list has been tested to determine whether the versions are affected. Other versions either no longer include security update support or may not be affected. To determine the support life cycle for your product and version, visit the Microsoft Support Lifecycle Web site.

Executive Summary:

This update resolves several newly-discovered, privately-reported vulnerabilities. Each vulnerability is documented in this bulletin in its own ?Vulnerability Details? section.

An attacker who successfully exploited the most severe of these vulnerabilities could take complete control of an affected system. An attacker could install then programs; view, change, or delete data; or create new accounts with full user rights.

We recommend that customers apply the update immediately.

http://www.microsoft.com/technet/security/...n/ms05-012.mspx