Sign up for the ITPro Today newsletter
Stay on top of the IT universe with commentary, news analysis, how-to's, and tips delivered to your inbox daily.
MS Word May Run Arbitrary Code via MS Access DB
Word's mail merge functionality can be used to cause arbitrary code to run on a system by using an MS Access 2000 database as the input for the merge operation.
ITPro Today Staff
August 6, 2000
1 Min Read
Reported August 7, 2000 by Georgi Guninski
VERSIONS EFFECTED
Microsoft Word
Microsoft Access 2000
DESCRIPTION
According to the discoverer's report, Microsoft Word can accept an MS Access 2000 database as input for a mail merge operation. However, the database file could contain Visual Basic code that could be made to run when the database is opened by MS Word. Such code could perform actions on the system without the user's knowledge.
DEMONSTRATION
Sample files are available at Georgi's Web site:
http://www.nat.bg/~joro/wordaccess.doc
http://www.nat.bg/~joro/db4.mdb
VENDOR RESPONSE
Microsoft is aware of the issue however no response was known at the time of this writing.
CREDIT
Discovered by Georgi Guninski
About the Author
You May Also Like
.png?width=700&auto=webp&quality=80&disable=upscale)