鬼仔's Blog

来源:Sowhat的blog

Microsoft Word Bulleted List Handling Remote Memory Corruption Vulnerability

http://www.securityfocus.com/data/vulnerabilities/exploits/crash-word-1.doc
http://www.securityfocus.com/data/vulnerabilities/exploits/crash-word-2.doc
http://www.securityfocus.com/data/vulnerabilities/exploits/crash-word-3.doc
http://www.securityfocus.com/data/vulnerabilities/exploits/crash-word-4.doc

或者统一打包 http://packetstormsecurity.org/0806-exploits/msword-crash.tgz

来源：sowhat的blog

SANS Warns of Critical MS Word Vulnerability

SANS通报了一个新的Word洞洞,称已经上报给MS了. 还好只影响2000和2003.
推荐使用2003的同学,启用MOICE.
使用2000的同学, 送你8个字, “人为刀俎 你是鱼肉”
阅读全文 »

来源：gyzy's Blog

Microsoft Office Word 0day Poc

在打齐补丁的Word2003上可以导致Dos

出错的代码是 mov eax,[ecx]，假如ecx可控的话改写四字节获得控制权并非没有可能

下载地址：270184437-word-poc.rar