CVE-2005-4131

Microsoft Excel 95/97/2000/2002/2003/2004 - Malformed Range Memory Corruption

Severity Score

6.8

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via an Excel file with a malformed range, which could lead to memory corruption involving an argument to the msvcrt.memmove function, aka "Brand new Microsoft Excel Vulnerability," as originally placed for sale on eBay as item number 7203336538.

*Credits: N/A

CVSS Scores

NISTv2 6.8

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2005-12-08 First Exploit
2005-12-09 CVE Reserved
2005-12-09 CVE Published
2024-08-07 CVE Updated
2024-11-15 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CAPEC

References (26)

URL	Tag	Source
http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&item=7203336538	X_refsource_misc
http://informationweek.com/story/showArticle.jhtml?articleID=174910198	X_refsource_misc
http://news.com.com/2061-10789_3-5988086.html	X_refsource_misc
http://news.zdnet.com/2100-1009_22-5989078.html	X_refsource_misc
http://securityreason.com/securityalert/584	Third Party Advisory
http://securityreason.com/securityalert/591	Third Party Advisory
http://securitytracker.com/id?1015333	Vdb Entry
http://securitytracker.com/id?1015766	Vdb Entry
http://support.avaya.com/elmodocs2/security/ASA-2006-069.htm	X_refsource_confirm
http://www.dicks-blog.com/archives/2005/12/08/excel-vulnerability-for-sale	X_refsource_misc
http://www.eweek.com/article2/0%2C1759%2C1899697%2C00.asp?kc=EWRSS03129TX1K0000614	X_refsource_misc
http://www.kb.cert.org/vuls/id/642428	Third Party Advisory
http://www.osvdb.org/blog/?p=71	X_refsource_misc
http://www.securityfocus.com/archive/1/427635/100/0/threaded	Mailing List
http://www.securityfocus.com/archive/1/427698/100/0/threaded	Mailing List
http://www.securityfocus.com/news/11363	X_refsource_misc
http://www.theage.com.au/news/breaking/excel-flaw-up-for-sale-on-ebay/2005/12/09/1134086783318.html	X_refsource_misc
http://www.theregister.co.uk/2005/12/10/ebay_pulls_excel_vulnerability_auction	X_refsource_misc
http://www.us-cert.gov/cas/techalerts/TA06-073A.html	Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/23537	Vdb Entry

URL	Date	SRC
https://www.exploit-db.com/exploits/26769	2005-12-08

URL	Date	SRC
http://www.securityfocus.com/bid/15780	2023-11-07

URL	Date	SRC
http://secunia.com/advisories/19138	2023-11-07
http://secunia.com/advisories/19238	2023-11-07
http://www.vupen.com/english/advisories/2006/0950	2023-11-07
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-012	2023-11-07

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Microsoft Search vendor "Microsoft"		Excel Search vendor "Microsoft" for product "Excel"				95 Search vendor "Microsoft" for product "Excel" and version "95"		-		Affected
Microsoft Search vendor "Microsoft"		Excel Search vendor "Microsoft" for product "Excel"				97 Search vendor "Microsoft" for product "Excel" and version "97"		-		Affected
Microsoft Search vendor "Microsoft"		Excel Search vendor "Microsoft" for product "Excel"				97 Search vendor "Microsoft" for product "Excel" and version "97"		sr1		Affected
Microsoft Search vendor "Microsoft"		Excel Search vendor "Microsoft" for product "Excel"				97 Search vendor "Microsoft" for product "Excel" and version "97"		sr2		Affected
Microsoft Search vendor "Microsoft"		Excel Search vendor "Microsoft" for product "Excel"				2000 Search vendor "Microsoft" for product "Excel" and version "2000"		-		Affected
Microsoft Search vendor "Microsoft"		Excel Search vendor "Microsoft" for product "Excel"				2000 Search vendor "Microsoft" for product "Excel" and version "2000"		sp2		Affected
Microsoft Search vendor "Microsoft"		Excel Search vendor "Microsoft" for product "Excel"				2000 Search vendor "Microsoft" for product "Excel" and version "2000"		sp3		Affected
Microsoft Search vendor "Microsoft"		Excel Search vendor "Microsoft" for product "Excel"				2000 Search vendor "Microsoft" for product "Excel" and version "2000"		sr1		Affected
Microsoft Search vendor "Microsoft"		Excel Search vendor "Microsoft" for product "Excel"				2002 Search vendor "Microsoft" for product "Excel" and version "2002"		-		Affected
Microsoft Search vendor "Microsoft"		Excel Search vendor "Microsoft" for product "Excel"				2002 Search vendor "Microsoft" for product "Excel" and version "2002"		sp1		Affected
Microsoft Search vendor "Microsoft"		Excel Search vendor "Microsoft" for product "Excel"				2002 Search vendor "Microsoft" for product "Excel" and version "2002"		sp2		Affected
Microsoft Search vendor "Microsoft"		Excel Search vendor "Microsoft" for product "Excel"				2002 Search vendor "Microsoft" for product "Excel" and version "2002"		sp3		Affected
Microsoft Search vendor "Microsoft"		Excel Search vendor "Microsoft" for product "Excel"				2003 Search vendor "Microsoft" for product "Excel" and version "2003"		-		Affected
Microsoft Search vendor "Microsoft"		Excel Search vendor "Microsoft" for product "Excel"				2003 Search vendor "Microsoft" for product "Excel" and version "2003"		sp1		Affected