Vulnerabilities > CVE-2002-0616 - Unspecified vulnerability in Microsoft Excel and Office

047910
CVSS 5.1 - MEDIUM
Attack vector
NETWORK
Attack complexity
HIGH
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
high complexity
microsoft
nessus

Summary

The Macro Security Model in Microsoft Excel 2000 and 2002 for Windows allows remote attackers to execute code by attaching an inline macro to an object within an Excel workbook, aka the "Excel Inline Macros Vulnerability."

Vulnerable Configurations

Part Description Count
Application
Microsoft
7

Nessus

NASL familyWindows : Microsoft Bulletins
NASL idSMB_NT_MS02-031.NASL
descriptionThe versions of Microsoft Word and Excel installed on the remote host are missing a security update. They are, therefore, affected by multiple vulnerabilities : - A security bypass vulnerability exists in Excel due to improper handling of formatted inline macros that are attached to objects within a workbook. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted workbook, to execute macros outside the constraints of the Macro Security Model. (CVE-2002-0616) - A security bypass vulnerability exists in Excel due to improper handling of macros in a workbook when it is opened through a hyperlink associated with a drawing shape in another workbook. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted workbook, to execute macros outside the constraints of the Macro Security Model. (CVE-2002-0617) - A flaw exists in the Macro Security Model in Excel due to a failure to correctly detect the presence of HTML scripting within an Excel workbook that contains an XSL stylesheet. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted file, to execute arbitrary HTML scripts. (CVE-2002-0618) - A flaw exists in Word when opening Mail Merge documents that have been saved in HTML format. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted document, to execute arbitrary VBA code in Access. (CVE-2002-0619)
last seen2020-06-01
modified2020-06-02
plugin id11336
published2003-03-10
reporterThis script is Copyright (C) 2003-2018 Tenable Network Security, Inc.
sourcehttps://www.tenable.com/plugins/nessus/11336
titleMS02-031: Cumulative patches for Excel and Word for Windows (324458)