CVE-2005-4131

Description

Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via an Excel file with a malformed range, which could lead to memory corruption involving an argument to the msvcrt.memmove function, aka "Brand new Microsoft Excel Vulnerability," as originally placed for sale on eBay as item number 7203336538.

6.8

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 69.09% Top 5%

Vendor Advisory microsoft.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory vupen.com

Affected: n/a n/a

References

Link	Tags
https://exchange.xforce.ibmcloud.com/vulnerabilities/23537	vdb entry
http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&item=7203336538
http://www.securityfocus.com/bid/15780	vdb entry patch
http://www.eweek.com/article2/0%2C1759%2C1899697%2C00.asp?kc=EWRSS03129TX1K0000614
http://securityreason.com/securityalert/584	third party advisory
http://informationweek.com/story/showArticle.jhtml?articleID=174910198
http://www.vupen.com/english/advisories/2006/0950	vdb entry vendor advisory
http://news.zdnet.com/2100-1009_22-5989078.html
http://www.theage.com.au/news/breaking/excel-flaw-up-for-sale-on-ebay/2005/12/09/1134086783318.html
http://support.avaya.com/elmodocs2/security/ASA-2006-069.htm
http://securityreason.com/securityalert/591	third party advisory
http://secunia.com/advisories/19238	third party advisory vendor advisory
http://www.theregister.co.uk/2005/12/10/ebay_pulls_excel_vulnerability_auction/
http://www.us-cert.gov/cas/techalerts/TA06-073A.html	third party advisory us government resource
http://secunia.com/advisories/19138	third party advisory vendor advisory
http://www.osvdb.org/blog/?p=71
http://securitytracker.com/id?1015333	vdb entry
http://www.securityfocus.com/archive/1/427635/100/0/threaded	mailing list
http://www.dicks-blog.com/archives/2005/12/08/excel-vulnerability-for-sale/
http://securitytracker.com/id?1015766	vdb entry
http://www.kb.cert.org/vuls/id/642428	third party advisory us government resource
http://www.securityfocus.com/archive/1/427698/100/0/threaded	mailing list
http://www.securityfocus.com/news/11363
http://news.com.com/2061-10789_3-5988086.html
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-012	vendor advisory

Frequently Asked Questions

What is the severity of CVE-2005-4131?: CVE-2005-4131 has been scored as a medium severity vulnerability.
How to fix CVE-2005-4131?: To fix CVE-2005-4131, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2005-4131 being actively exploited in the wild?: It is possible that CVE-2005-4131 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~69% probability that this vulnerability will be exploited by malicious actors in the next 30 days.