Ms Jet Database Engine Db File Parsing Vuln...

FYI…

- http://secunia.com/advisories/14896/
"Release Date: 2005-04-12 …
Critical: Highly critical
Impact: System access
Where: From remote
Solution Status: Unpatched
Description:
…The vulnerability is caused due to a memory handling error when e.g. parsing database files. This can be exploited to execute arbitrary code by tricking a user into opening a specially crafted ".mdb" file in Microsoft Access. NOTE: Exploit code has been posted to a public mailing list. The vulnerability has been confirmed on a fully patched system with Microsoft Access 2003 (msjet40.dll version 4.00.8618.0) and Microsoft Windows XP SP1/SP2. Other versions may also be affected.
Solution:
Do not open untrusted ".mdb" database files…"

"Backdoor.Ryejet"
- http://www.sarc.com/avcenter/venc/data/backdoor.ryejet.html
Last Updated on: April 20, 2005 12:04:40 PM
"…back door Trojan horse that allows unauthorized remote access to a compromised computer. The Trojan also contains rootkit functionality to hide the presence of its files on the compromised computer. The threat may be distributed embedded in a Microsoft Jet Database…"

More on this:

- http://www.cve.mitre.org/cgi-bin/cvename.c…e=CAN-2005-0944

- http://securityresponse.symantec.com/avcen…exploit.36.html
Last Updated on: April 18, 2005
"Bloodhound.Exploit.36 is a heuristic detection for the Microsoft Jet Database Engine Malformed Database File Buffer Overflow Vulnerability (described in Bugtraq ID 12960)".

- http://www.securityfocus.com/bid/12960
updated - Apr 19, 2005
"…Vulnerable:
Microsoft JET 2.0 + Microsoft Access 2.0, Microsoft JET 2.5 + Microsoft Access 2.0 SP1, Microsoft JET 3.0 + Microsoft Access 95, Microsoft JET 3.5 + Microsoft Access 95 + Microsoft Access 97, Microsoft JET 3.51 SP3 Microsoft JET 3.51 + Microsoft Excel 95 + Microsoft Excel 97, Microsoft JET 4.0 SP7 Microsoft JET 4.0 SP6 Microsoft JET 4.0 SP5 SP4 SP3 SP2 SP1 Microsoft JET 4.0 + Microsoft Access 2000 …"