Microsoft PowerPoint Viewer TextBytesAtom Record Stack Overflow Remote Code Execution Vulnerability

Bugtraq ID:	38107
Class:	Boundary Condition Error
CVE:	CVE-2010-0033
Remote:	Yes
Local:	No
Published:	Feb 09 2010 12:00AM
Updated:	May 14 2010 05:26PM
Credit:	SkD of Zero Day Initiative
Vulnerable:	Microsoft PowerPoint 2003 SP3 + Microsoft Office 2003 SP3 Microsoft PowerPoint 2003 SP2 + Microsoft Office 2003 SP2 Microsoft PowerPoint 2003 SP1 + Microsoft Office 2003 SP1 Microsoft PowerPoint 2003 0 + Microsoft Office 2003 0
Not Vulnerable:

Microsoft PowerPoint Viewer TextBytesAtom Record Stack Overflow Remote Code Execution Vulnerability

Microsoft PowerPoint Viewer is prone to a remote code-execution vulnerability.

An attacker can exploit this issue by enticing an unsuspecting user to open a malicious PowerPoint file.

Successful exploits would allow the attacker to execute arbitrary code in the context of the currently logged-in user.

Microsoft PowerPoint Viewer TextBytesAtom Record Stack Overflow Remote Code Execution Vulnerability

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

The following exploit for the Metasploit Framework is available:

• /data/vulnerabilities/exploits/38107.rb

Microsoft PowerPoint Viewer TextBytesAtom Record Stack Overflow Remote Code Execution Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for details.


Microsoft PowerPoint 2003 SP3

• Microsoft Security Update for Microsoft Office PowerPoint 2003 (KB976881)
  http://www.microsoft.com/downloads/details.aspx?familyid=2291ae24-fa39 -4ad8-a7d0-12726b68ad96

Microsoft PowerPoint Viewer TextBytesAtom Record Stack Overflow Remote Code Execution Vulnerability

References:

• Microsoft PowerPoint Homepage (Microsoft)
  
• ZDI-10-017: Microsoft Office PowerPoint Viewer TextBytesAtom Record Remote Code (ZDI Disclosures )
  
• Microsoft Security Bulletin MS10-004 (Microsoft)
  
• ZDI-10-017: Microsoft Office PowerPoint Viewer TextBytesAtom Record Remote Code (Zero Day Initiative)