COMMAND

    office and its components

SYSTEMS AFFECTED

    - Microsoft Converter Pack 2000 for Windows
    - Microsoft Office 2000 for Windows with Multilanguage Pack
    - Japanese, Korean, Chinese (Simplified and Traditional) versions of:
       - Microsoft Word 97, 98 and 2000 for Windows, which is available as a standalone product or as part of:
          - Office 97, Office 97 Powered by Word 98, Office 2000 for Windows
          - Works Suite 2000 for Windows
       - Microsoft PowerPoint 97 and 2000 for Windows, which is available as a standalone product or as part of:
          - Office 97, Office 97 Powered by Word 98, Office 2000 for Windows

PROBLEM

    Microsoft  Office  includes  a  conversion  utility  that converts
    older  Word  documents  to  more  recent  formats.  The conversion
    utility for Word  5 documents in  East Asian languages  (Japanese,
    Korean,  Simplified  Chinese  and  Traditional  Chinese)  has   an
    unchecked  buffer.   By  using  a  hexadecimal  editor  to  insert
    specially-malformed information into a document, a malicious  user
    could  cause  Word  to  run  code  of  his  or her choice when the
    document was opened using an affected version of the converter.

    A  Word  5  converter  installs  by  default  as  part of Word and
    PowerPoint,  and  can  be  installed  at  user behest as part of a
    converter pack.  However, the vulnerability affects only the  East
    Asian language  versions of  the converter,  and only  the Windows
    versions of them. No other language versions of the converter  are
    affected,  and  no  version  of  the  converter  for  Macintosh is
    affected.

SOLUTION

    Patch availability:

      - Word 97 or 98, PowerPoint 98:
        - US: http://officeupdate.microsoft.com/downloaddetails/ww5pkg.htm
        - Japan: http://officeupdate.microsoft.com/japan/downloaddetails/MalformedData-97.htm
        - Korea: http://officeupdate.microsoft.com/korea/downloaddetails/MalformedData-97.htm
        - China: http://officeupdate.microsoft.com/china/downloaddetails/MalformedData-97.htm
        - Taiwan: http://officeupdate.microsoft.com/taiwan/downloaddetails/MalformedData-97.htm
        - Hong Kong: http://officeupdate.microsoft.com/hk/downloaddetails/MalformedData-97.htm

      - Converter Pack 2000; Office 2000 with Multilanguage Pack; Word 2000, PowerPoint 2000:
        - US: http://officeupdate.microsoft.com/2000/downloaddetails/ww5pkg.htm
        - Japan: http://officeupdate.microsoft.com/japan/downloaddetails/2000/MalformedData-2K.htm
        - Korea: http://officeupdate.microsoft.com/korea/downloaddetails/2000/MalformedData-2K.htm
        - China: http://officeupdate.microsoft.com/china/downloaddetails/2000/MalformedData-2K.htm
        - Taiwan: http://officeupdate.microsoft.com/taiwan/downloaddetails/2000/MalformedData-2K.htm
        - Hong Kong: http://officeupdate.microsoft.com/hk/downloaddetails/2000/MalformedData-2K.htm