Title:     Flaw in Microsoft Word Could Enable Macros to Run
           Automatically (827653)
Date:      September 3, 2003
Software:  Microsoft Word 97
           Microsoft Word 98 (J)
           Microsoft Word 2000
           Microsoft Word 2002
           Microsoft Works Suite 2001
           Microsoft Works Suite 2002
           Microsoft Works Suite 2003
Impact:    Run macros without warning
Max Risk:  Important
Bulletin:  MS03-035

Microsoft encourages customers to review the Security Bulletins at:

http://www.microsoft.com/technet/security/bulletin/MS03-035.asp
http://www.microsoft.com/security/security_bulletins/MS03-035.asp

- -------------------------------------------------------------------

Issue:
======
A macro is a series of commands and instructions that can be
grouped together as a single command to accomplish a task
automatically. Microsoft Word supports the use of macros to allow
the automation of commonly performed tasks. Since macros are
executable code it is possible to misuse them, so Microsoft Word
has a security model designed to validate whether a macro should be
allowed to execute depending on the level of macro security the
user has chosen.

A vulnerability exists because it is possible for an attacker to
craft a malicious document that will bypass the macro security
model. If the document was opened, this flaw could allow a
malicious macro embedded in the document to be executed
automatically, regardless of the level at which macro security is
set. The malicious macro could take the same actions that the user
had permissions to carry out, such as adding, changing or deleting
data or files, communicating with a web site or formatting the hard
drive.

The vulnerability could only be exploited by an attacker who
persuaded a user to open a malicious document - there is no way for
an attacker to force a malicious document to be opened.

Mitigating Factors:
====================
 - The user must open the malicious document for an attacker to be
   successful. An attacker cannot force the document to be opened
   automatically.

 - The vulnerability cannot be exploited automatically through e-
   mail. A user must open an attachment sent in e-mail for an e-
   mail borne attack to be successful.

 - By default, Outlook 2002 block programmatic access to the
   Address Book. In addition, Outlook 98 and 2000 block
   programmatic access to the Outlook Address Book if the Outlook
   Email Security Update has been installed. Customers who use any
   of these products would not be at risk of propagating an e-mail
   borne attack that attempted to exploit this vulnerability.

 - The vulnerability only affects Microsoft Word - other members of
   the Office product family are not affected.

Risk Rating:
============
 -Important

Patch Availability:
===================
 - A patch is available to fix this vulnerability. Please read the
   Security Bulletins at

  http://www.microsoft.com/technet/security/bulletin/MS03-035.asp
  http://www.microsoft.com/security/security_bulletins/MS03-035.asp

   for information on obtaining this patch.

Acknowledgment:
===============
 - Jim Bassett of Practitioners Publishing Company
(http://www.ppcnet.com)
- -------------------------------------------------------------------

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.