TechSpot

Buffer Overrun in WordPerfect Converter

By TS | Thomas
Sep 3, 2003
Topic Status:
Not open for further replies.
  1. Affected Software:
    Microsoft Office 97, 2000 & XP
    Microsoft Word 98 (J)
    Microsoft FrontPage 2000 & 2002
    Microsoft Publisher 2000 & 2002
    Microsoft Works Suite 2001, 2000 & 2002

    There is a flaw in the way that the Microsoft WordPerfect converter handles Corel WordPerfect documents. A security vulnerability results because the converter does not correctly validate certain parameters when it opens a WordPerfect document, which results in an unchecked buffer. As a result, an attacker could craft a malicious WordPerfect document that could allow code of their choice to be executed if an application that used the WordPerfect converter opened the document. Microsoft Word and Microsoft PowerPoint (which are part of the Office suite), FrontPage (which is available as part of the Office suite or separately), Publisher, & Microsoft Works Suite can all use the Microsoft Office WordPerfect converter.

    The vulnerability could only be exploited by an attacker who persuaded a user to open a malicious WordPerfect document—there is no way for an attacker to force a malicious document to be opened or to trigger an attack automatically by sending an e-mail message.

    Patch availability
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.