What's the scope of the vulnerability?
This is a denial of service vulnerability. A malicious user could use it to cause a running Office X application to fail, forcing the user to restart the application. Any unsaved data when the application crashed would be lost.
An attack would not affect the stability of the underlying operating system, nor allow an attacker to alter or delete data. Also, a successful attach could only cause one application to fail on a machine: specifically, the first Office v. X application loaded of those running when the attack occurs. All other Office v. X applications would continue to function normally.
What causes the vulnerability?
The vulnerability results because the network PID checking feature fails to handle exceptional circumstances properly.
What is Network PID Checking?
Each legally purchased and installed copy of Microsoft software has a unique Product Identifier (PID). This Identifier can be seen in most applications by going to "Help" "About". The unique PID is listed there.
Network Product Identification Checking is an anti-piracy feature new to Office X for OS X. When an Office X application starts, it announces its PID on the local network at regular intervals. It also listens on the local network for new PID announcements. If at any point, an installation of Office X detects a copy of its own PID, Office shuts down on both systems.
What's wrong with Network PID Checking?
There is an implementation flaw in the Network PID Checking feature. The Network PID checking fails to handle specially malformed network requests properly. When these circumstances occur or a specially malformed request is received, Office X does not handle the condition gracefully and fails.
How could an attacker exploit this vulnerability?
An attacker could attempt to exploit this vulnerability by sending a specially crafted network packet one of two ways: they could attempt to send the packet directly to a single user's machine; or, they could attempt to send this packet to all the computers on a subnet by specifying a broadcast address.
How would an attack directed at a single user work?
To attack a single user's machine, the attacker would send the specially malformed packet to the user's IP address. The advantage of this type of attack is that he could mount an attack on any machine they could deliver an IP packet to. This would allow an attacker to potentially mount attacks over great distances.
However, to succeed, the attacker would need to know the IP address of the intended victim. In most cases, IP addresses are assigned by Dynamic Host Configuration Protocol (DHCP) and so a single machines IP address can change.
Also, a directed attack like this would have to use the destination ports that the Network PID Checker uses: 2222 and those greater than 3000. Most corporations block inbound traffic on high ports such as these as a best practice.
How would an attack directed at a broadcast or multicast address work?
To attack many users on a subnet, the attacker would send the specially malformed packet to that network's broadcast or multicast address. The advantage to this type of attack is that the attacker could deliver their malicious packet to all computers on a subnet, potentially causing many users' Office application to fail.
The disadvantage to this attack method is that most routers and firewalls do not forward multicast or broadcast packets. As a result, an attacker would most likely only be able to disrupt Office applications on a single network segment.
What could an attacker do via this vulnerability?
An attacker could cause the Office X applications on the victims machine to fail, forcing the user to restart. While any unsaved data would be lost, there would be no opportunity for the attacker to alter data. Additionally, an attacker could not run programs or destabilize the operating system in any way.
If several Office X applications were running when an attack was launched, would all of them fail?
No. Only the first application that a user had loaded would fail. Any other applications that were running at the time would continue to run normally. For example, if a user had starting Word and Excel in that order, and then received the malformed packet, Word would fail, but Excel would continue to function. The user could then restart Word, and continue working.
Is it possible for these circumstances or packets to occur by accident?
No In nearly every case, the network traffic or packets would have to be hand-crafted by a user with malicious intent.
I'm running Office on a PC. Could I be affected?
No. The network PID checking feature discussed is only available in Office v. X
I'm using Mac OS X, but I'm using a version of Office other than Office v. X. Could I be affected?
No. The network PID checking feature discussed is only available in Office v. X.
What does the patch do?
The patch eliminates the vulnerability by allowing the Network PID checker to operate successfully under exceptional circumstances and to discard malformed packets.
