Home > Research > X-Force Database > X-Force Database Results

Microsoft Word RTF document automatic macro execution

word-rtf-macro-execution (6571)

High Risk

Description:

A vulnerability in Microsoft Word for Windows and Macintosh could allow the automatic execution of macros when Rich Text Format (RTF) documents are opened. An attacker could create a malicious macro that can be used to add, modify, or delete files and modify system settings. If the attacker embeds the macro within a template and links an RTF document to that template, the macro can be made to run automatically when the document is opened. An attacker could use this vulnerability to change data, communicate with various Web sites, reformat the hard drive or change the security settings in Word.

Platforms Affected:

• Microsoft Corporation: Microsoft Word 2000
• Microsoft Corporation: Microsoft Word 2001 for the Mac
• Microsoft Corporation: Microsoft Word 97
• Microsoft Corporation: Microsoft Word 98 (Japanese)
• Microsoft Corporation: Microsoft Word 98 for the Mac

Remedy:

Apply the appropriate patch for your system, as listed in Microsoft Security Bulletin MS01-028. See References.

Consequences:

Gain Access

References:

• CERT Vulnerability Note VU#345576, Microsoft Word does not check for macros contained in linked template file when opening RTF document at http://www.kb.cert.org/vuls/id/345576.
• Microsoft Security Bulletin MS01-028, RTF document linked to template can run macros without warning at http://www.microsoft.com/technet/security/bulletin/ms01-028.mspx.

Standards associated with this entry:

• BID-2753: Microsoft Word RTF Template Macro Execution Vulnerability
• CVE-2001-0240: Microsoft Word before Word 2002 allows attackers to automatically execute macros without warning the user via a Rich Text Format (RTF) document that links to a template with the embedded macro.

Reported:

May 21, 2001

The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

Copyright (c) 1994-2005 Internet Security Systems, Inc. All rights reserved worldwide.

For corrections or additions please email xforce@iss.net

Return to the main page