CVE-2006-3649: Buffer Overflow
First published: Wed Aug 09 2006(Updated: )
Buffer overflow in Microsoft Visual Basic for Applications (VBA) SDK 6.0 through 6.4, as used by Microsoft Office 2000 SP3, Office XP SP3, Project 2000 SR1, Project 2002 SP1, Access 2000 Runtime SP3, Visio 2002 SP2, and Works Suite 2004 through 2006, allows user-assisted attackers to execute arbitrary code via unspecified document properties that are not verified when VBA is invoked to open documents.
Credit: secure@microsoft.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft Visual Basic SDK | =6.3 | |
| Microsoft Visual Basic SDK | =6.4 | |
| Microsoft Visual Basic SDK | =6.2 | |
| Microsoft Visual Basic SDK | =6.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.us-cert.gov/cas/techalerts/TA06-220A.html
- http://www.kb.cert.org/vuls/id/159484
- http://www.securityfocus.com/bid/19414
- http://securitytracker.com/id?1016656
- http://secunia.com/advisories/21408
- http://www.vupen.com/english/advisories/2006/3214
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A694
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-047
Frequently Asked Questions
What is the severity of CVE-2006-3649?
CVE-2006-3649 is considered a critical vulnerability due to the potential for remote code execution.
How do I fix CVE-2006-3649?
To mitigate CVE-2006-3649, users should upgrade to the latest version of Microsoft Office that does not include this vulnerability.
What products are affected by CVE-2006-3649?
CVE-2006-3649 affects Microsoft Visual Basic for Applications SDK versions 6.0 through 6.4 and specific Microsoft Office products.
What are the implications of CVE-2006-3649?
Exploitation of CVE-2006-3649 could allow attackers to execute arbitrary code on the victim's system.
Is there a workaround for CVE-2006-3649?
A temporary workaround for CVE-2006-3649 is to disable VBA in Microsoft Office applications until a patch is applied.
- agent/references
- agent/type
- agent/event
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/remedy
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- agent/severity
- agent/weakness
- agent/author
- agent/description
- vendor/microsoft
- canonical/microsoft visual basic sdk
- version/microsoft visual basic sdk/6.3
- version/microsoft visual basic sdk/6.4
- version/microsoft visual basic sdk/6.2