Reported August 7, 2000 by Georgi Guninski

VERSIONS EFFECTED
Microsoft Word
  • Microsoft Access 2000
  • DESCRIPTION

    According to the discover
    er's report, Microsoft Word can accept an MS Access 2000 database as input for a mail merge operation. However, the database file could contain Visual Basic code that could be made to run when the database is opened by MS Word. Such code could perform actions on the system without the user's knowledge. 

    DEMONSTRATION

    Sample files are available at Georgi's Web site:
    http://www.nat.bg/~joro/wordaccess.doc
    http://www.nat.bg/~joro/db4.mdb

    VENDOR RESPONSE

    Microsoft is aware of the issue however no response was known at the time of this writing.

    CREDIT
    Discovered by Georgi Guninski