Signature Detail

HTTP: Null Encoding

This signature detects null characters (%00) in URLs. Attackers can use null characters to cause the Web server to produce unpredictable results.

Extended Description

A remote buffer overflow vulnerability affects Microsoft Office XP. The problem presents itself when an unsuspecting user follows a malicious HTML link that points to a Office document. A boundary condition error is exposed during this operation that may allow attacker-specified data to corrupt process memory. An attacker may leverage this issue to execute arbitrary code with the privileges of an unsuspecting user that follows a malicious embedded link.

Affected Products

• Microsoft office_xp SP1
• Microsoft office_xp SP2
• Microsoft office_xp SP3
• Microsoft office_xp
• Microsoft powerpoint_2002 SP1
• Microsoft powerpoint_2002 SP2
• Microsoft powerpoint_2002 SP3
• Microsoft powerpoint_2002
• Microsoft project_2002 SP1
• Microsoft project_2002
• Microsoft visio_2002 SP1
• Microsoft visio_2002 SP2
• Microsoft visio_2002
• Microsoft visio_2002_professional SP2
• Microsoft visio_2002_standard SP2
• Microsoft word_2002 SP1
• Microsoft word_2002 SP2
• Microsoft word_2002 SP3
• Microsoft word_2002
• Microsoft works_suite_2002
• Microsoft works_suite_2003
• Microsoft works_suite_2004

References

• CVE: CVE-2004-0848