Jet Engine buffer overflow - trying to understand

[kaykrazy]

I am researching a recently announced buffer overflow vulnerability with Jet Engine. I am trying to understand how an mdb file can be used if Microsoft Access is not installed on the device.

I am talking about this one. http://free.7host06.com/hexview/docs/20050331-1.txt

I thought I heard somewhere that if you use VB you could write code to retrieve records in the mdb. (I'm assuming only tables in the mdb). What about within word or other office products could vb there open the mdb and cause the overflow.

Thanks for any help

Kathy

 

[SydneyGeek]

You can use Access as a data source for most of the Office package, without the users having Access installed on their machines. Of course, you have to hide the file away from them so no-one tries to open the .mdb file and corrupting it.
Basically, you use ADO (or, on Office 97, DAO) to push data to Access from Excel and retrieve it. By using SQL you can append fields, append and delete records, and it's all pretty quick -- writing 1000 records using ADO takes only a few seconds, and retrieving thousands of records is almost instantaneous.

As for the buffer overrun issue, I hadn't seen that before. I assume that you could write code from Excel / Word etc to trigger the exception, so it would be possible to crash the database, but I'd be more worried in most work environments with users casually opening files just out of curiosity.

My 2 cents...

Denis