Microsoft releases Security Bulletin MS12-046 - Important

Microsoft has released Security Bulletin MS12-046 which resolves a privately reported vulnerability in Microsoft Visual Basic for Applications (VBA).

The complete Security Bulletin can be found here

Summit has made the updated version of the Visual Basic for Applications SDK that addresses the vulnerability described in this bulletin available here for independent software vendors (ISVs).

The direct link to the VBAOF11 Debug 1054. 

The direct link to the VBAOF11 Release 1054

From the Security Bulletin...

General Information

Executive Summary

This security update resolves one publicly disclosed vulnerability in Microsoft Visual Basic for Applications. The vulnerability could allow remote code execution if a user opens a legitimate Microsoft Office file (such as a .docx file) that is located in the same directory as a specially crafted dynamic link library (DLL) file. An attacker could then install programs; view, change, or delete data; or create new accounts that have full user rights. If a user is logged on with administrative user rights, an attacker could take complete control of the affected system. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

This security update is rated Important for all supported versions of Microsoft Visual Basic for Applications SDK and third-party applications that use Microsoft Visual Basic for Applications. This security update is also rated Important for all supported editions of Microsoft Office 2003 SP3, Microsoft Office 2007 SP2, and Microsoft Office 2010. For more information, see the subsection, Affected and Non-Affected Software, in this section.

The security update addresses the vulnerability by correcting how Microsoft Visual Basic for Applications loads external libraries. For more information about the vulnerability, see the Frequently Asked Questions (FAQ) subsection for the specific vulnerability entry under the next section, Vulnerability Information.