Microsoft Office Web Components ActiveX Control Code Execution Vulnerability

This host is installed with Microsoft Office Web Components ActiveX Control and is prone to code execution vulnerability.

- Error exists in the OWC10.Spreadsheet ActiveX control that can be exploited via specially crafted parameters passed to the 'msDataSourceObject()' method. - Error occurs when loading and unloading the OWC10 ActiveX control. - Error exists in the OWC10.Spreadsheet ActiveX control related to the 'BorderAround()' method via accessing certain methods in a specific order. - A boundary error in the Office Web Components ActiveX control which can be exploited to cause a buffer overflow.

Microsoft Office XP/2003 SP 3 and prior Microsoft Visual Studio .NET 2003 SP 1 and prior Microsoft Office XP/2003 Web Components SP 3 and prior Microsoft ISA Server 2004 Standard/Enterprise Edition SP 3 and prior Microsoft ISA Server 2006 Standard/Enterprise Edition SP 1 and prior Microsoft Office 2003 Web Components for 2007 Microsoft Office system SP 1

The vendor has released updates. Please see the references for more information. As a workaround set the killbit for the following CLSIDs: {0002E541-0000-0000-C000-000000000046}, {0002E559-0000-0000-C000-000000000046}, {0002E55B-0000-0000-C000-000000000046}