Microsoft Office 'OfficeArtSpgr' Container Pointer Overwrite Remote Code Execution Vulnerability

Bugtraq ID:	38073
Class:	Input Validation Error
CVE:	CVE-2010-0243
Remote:	Yes
Local:	No
Published:	Feb 09 2010 12:00AM
Updated:	Feb 09 2010 06:11PM
Credit:	Damian Frizza of Core Security Technologies
Vulnerable:	Microsoft Office XP SP3 + Microsoft Excel 2002 SP3 + Microsoft Excel 2002 SP3 + Microsoft FrontPage 2002 SP3 + Microsoft FrontPage 2002 SP3 + Microsoft Outlook 2002 SP3 + Microsoft Outlook 2002 SP3 + Microsoft PowerPoint 2002 SP3 + Microsoft PowerPoint 2002 SP3 + Microsoft Publisher 2002 SP3 + Microsoft Publisher 2002 SP3 Microsoft Office 2004 for Mac 0
Not Vulnerable:

Microsoft Office 'OfficeArtSpgr' Container Pointer Overwrite Remote Code Execution Vulnerability

Microsoft Office is prone to a remote code-execution vulnerability.

An attacker could exploit this issue by enticing a victim to open a malicious Office file.

Successful exploits would allow the attacker to execute arbitrary code in the context of the currently logged-in user.

Microsoft Office 'OfficeArtSpgr' Container Pointer Overwrite Remote Code Execution Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Microsoft Office 'OfficeArtSpgr' Container Pointer Overwrite Remote Code Execution Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for details.


Microsoft Office XP SP3

• Microsoft Security Update for Microsoft Office XP (KB977896)
  http://www.microsoft.com/downloads/details.aspx?familyid=47553f45-fa10 -40e5-8267-9d42ff560a62

Microsoft Office 2004 for Mac 0

• Microsoft Microsoft Office 2004 for Mac 11.5.7 Update
  http://www.microsoft.com/downloads/details.aspx?FamilyID=7c985595-00c5 -44b8-81c3-59d9967220f8

Microsoft Office 'OfficeArtSpgr' Container Pointer Overwrite Remote Code Execution Vulnerability

References:

• Microsoft Office Excel / Word OfficeArtSpgr Container Pointer Overwrite Vulnerab (Core Security Technologies)
  
• Microsoft Office Product Homepage (Microsoft)
  
• CORE-2009-0827: Microsoft Office Excel / Word OfficeArtSpgr Container Pointer Ov (CORE Security Technologies Advisories )
  
• Microsoft Security Bulletin MS10-003 (Microsoft)