dH team & SECURITY.NNOV: A variant of "Word Mail Merge" vulnerability

["ERRor" <error () pochtamt ru>]

Original version of this advisory:
http://www.security.nnov.ru/advisories/mailmerge.asp

Title:                     A variant of "Word Mail Merge" vulnerability
Authors:                   ERRor, 3APA3A
Date:                      May, 03 2002
Affected:                  Office 97, 2000, XP
Vendor:                    Microsoft
Risk:                      Average to high
Remote:                    for Office 2000 SR1a and prior
Exploitable:               Yes
Vendor notified:           February, 12 2002

Intro:

All  details  on  this  issue may be found in [1]. Original advisory [2]
about  Word  Mail  Merge  vulnerability  was  posted by Georgi Guninski.
Microsoft  released  an  advisory  and  fix  [3]  included into SR1a for
Microsoft Office.

Problem:

ERRor <error () pochtamt ru> discovered the way Microsoft fixed the problem
is  weak  and  it's  still  possible  to  exploit  this  problem. 3APA3A
<3APA3A () SECURITY NNOV RU>  found  a  remote  exploitation  scenario  for
Office 2000 SR1a + Outlook Express.

Description:

Microsoft decided to disallow dotted UNC paths (like \\111.111.111.111\)
for merge documents as a fix. It's still possible to use any absolute or
relative  paths  to  make word document to open macro silently in Office
97,  2000  and  XP.  This  vulnerability  can  be  remotely exploited if
attacker  can  put both Word and Access documents into the same location
or  to  put Access document into known location (for example to put both
files  into  same  Internet Explorer cache folder). Access file may have
any  extension  (.wav,  .html, .txt) it doesn't matter. Microsoft Office
2000  SR1a  +  SP2  and Microsoft Office XP + SP1 do not allow Access to
open  files from Temporary Internet Files folder, it makes it impossible
to exploit this vulnerability via Outlook Express.

Exploitation:

It's  possible  to  exploit  this  vulnerability  locally  or via social
Engineering  (for  example  to  craft an archive of 3 files: readme.doc,
setup.dat  and  setup.exe where setup.exe is trojan and setup.dat is MDB
file  launching  setup.exe,  if  user opens readme.doc setup.exe will be
started  automatically)  Simple extract [4] and open expl.doc - calc.exe
will  be  started.

Because  Outlooks  Express and Internet Explorer open .doc files without
warning it's possible to exploit this vulnerability remotely [5] without
user's intervention. Exploit works as follow:
 1. Both DOC and MDB files are attached with .doc extension
 2.  They are referenced via IFRAME tag. It makes both files to be saved
 into same cache folder and launched in MS Word.
 3. expl.doc opens exploit.doc and exploit.doc starts calc.exe
For  some  unknown reason Internet Explorer 6.0 strips 2 last characters
from filename in cache, so there is different .eml for Internet Explorer
6.0.

Vendor:

Microsoft  recommends  to  install  SP2 for Office 2000. It fixes remote
exploitation scenario via Outlook Express, but not local issue.

References:

1. Microsoft Word Mail Merge vulnerability
   http://www.security.nnov.ru/search/news.asp?binid=415
2. Georgi  Guninski,  MS  Word  and MS Access vulnerability - executing
   arbitrary programs, may be exploited by IE/Outlook
   http://www.security.nnov.ru/search/document.asp?docid=518
3. Microsoft Security Bulletin (MS00-071)
   Patch Available for "Word Mail Merge" Vulnerability
   http://www.microsoft.com/technet/security/bulletin/fq00-071.asp
4. Mail merge vulnerability local POC
   http://www.security.nnov.ru/files/mailmerge/2files.zip
5. Mail merge vulnerability Outlook Express POC
   http://www.security.nnov.ru/files/mailmerge/2mails.zip