Russian Vulnerability Scanner Database

Back to List

CVE-2006-2492

Scores

EPSS

0.753medium75.3%
0%20%40%60%80%100%

Percentile: 75.3%

CVSS

8.8high3.x
0246810

CVSS Score: 8.8/10

All CVSS Scores

CVSS 3.x
8.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS 2.0
7.6

Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C

Description

Buffer overflow in Microsoft Word in Office 2000 SP3, Office XP SP3, Office 2003 Sp1 and SP2, and Microsoft Works Suites through 2006, allows user-assisted attackers to execute arbitrary code via a malformed object pointer, as originally reported by ISC on 20060519 for a zero-day attack.

Scaner-VS 7 — a modern vulnerability management solution

Uses this database for vulnerability detection. High-speed search, cross-platform, advanced configuration audit, and flexible filtering. Suitable for organizations of any size.
Learn more about Scaner-VS 7

Sources

nvd

CWEs

CWE-120

Exploits

Exploit ID: CVE-2006-2492

Source: cisa

URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Recommendations

Source: nvd

Apply a patch from MicrosoftMicrosoft addresses this vulnerability with the updates listed in Microsoft Security Bulletin MS06-027.Do not open untrusted Word documentsDo not open unfamiliar or unexpected Word or other Office documents, particularly those hosted on web sites or delivered as email attachments. Please see Cyber Security Tip ST04-010 for more information.Consult Microsoft Security Bulletin MS06-027 and Microsoft Security Advisory (919637)Microsoft Security Bulletin MS06-027 and Microsoft Security Advisory (919637) list workarounds to reduce the chances of exploitation, includingRun Word in Safe Mode (winword.exe /safe)Do not use Word as the email editor in OutlookDo not rely on file name extension filteringIn most cases, Windows will call Word to open a document even if the document has an unknown file extension. For example, if document.qwer contains the correct file header information, Windows will open document.qwer with Word. Filtering for common extensions (e.g., .doc, .dot, .rtf) may not detect all Word documents.

URL: http://www.kb.cert.org/vuls/id/446012

Vulnerable Software (2)

Type: Configuration

Vendor: microsoft

Product: office

Operating System: * * *

Trait: 
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:microsoft:office:2000:sp3:*:*:*:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:a:microsoft:office:2003:sp1:*:*:*:*:*:*",...

Source: nvd

Type: Configuration

Vendor: microsoft

Product: works_suite

Operating System: * * *

Trait: 
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:microsoft:office:2000:sp3:*:*:*:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:a:microsoft:office:2003:sp1:*:*:*:*:*:*",...

Source: nvd