CVE:CVE-2006-1308
CNNVD:CNNVD-200607-220
Microsoft Excel是非常流行的电子表格办公软件。
Excel在使用特制的FNGROUPCOUNT值时存在内存破坏漏洞，远程攻击者可能利用此漏洞在用户机器上执行任意指令。
如果用户受骗打开了特制的Excel文件的话就会触发这个漏洞，导致执行任意指令。
漏洞代码如下：
==============================================================================
eax=0e0e0e0e ebx=0000fff1 ecx=00002241 edx=0000000f esi=00138964
edi=0013ffff
eip=30093040 esp=0013794c ebp=001388e4 iopl=0         nv up ei pl nz na
po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000
efl=00010206
*** ERROR: Symbol file could not be found.  Defaulted to export
symbols for Excel.EXE -
Excel!Ordinal41+0x93040:
30093040 f3ab             rep     stosd
es:0013ffff=74634100
Excel!Ordinal41+0x9302e:
3009302e 5c               pop     esp
3009302f f3ffff           rep     ???
30093032 8bd9             mov     ebx,ecx
30093034 c1e902           shr     ecx,0x2
30093037 8d7c1520         lea     edi,[ebp+edx+0x20]
3009303b b80e0e0e0e       mov     eax,0xe0e0e0e
30093040 f3ab             rep     stosd
> 0:000> g
> (b98.5fc): Access violation - code c0000005 (first chance) First
> chance exceptions are reported before any exception handling.
> This exception may be expected and handled.
> eax=00000000 ebx=00000000 ecx=0e0e0e0e edx=7c9037d8 esi=00000000
> edi=00000000
> eip=0e0e0e0e esp=0013757c ebp=0013759c iopl=0         nv up ei pl zr na
> po nc
> cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000
> efl=00010246
> 0e0e0e0e ??               ???
==============================================================================
solution:Upgrade microsoft excel to a higher version than 2000,2000:sp2,2000:sp3,2000:sr1,2002,2002:sp1,2002:sp2,2002:sp3,2003,2003:sp1,2004,x,and avoid the version 2000,2000:sp2,2000:sp3,2000:sr1,2002,2002:sp1,2002:sp2,2002:sp3,2003,2003:sp1,2004,x; Upgrade microsoft excel_viewer to a higher version than 2003,and avoid the version 2003