Microsoft Word Record RTF Parsing Engine Remote Heap Buffer Overflow Vulnerability

Bugtraq ID:	42133
Class:	Boundary Condition Error
CVE:	CVE-2010-1902
Remote:	Yes
Local:	No
Published:	Aug 10 2010 12:00AM
Updated:	Sep 15 2010 03:21PM
Credit:	wushi of team509 working with VeriSign iDefense Labs,
Vulnerable:	Microsoft Word 2007 SP2 Microsoft Word 2007 SP1 Microsoft Word 2007 0 Microsoft Word 2003 SP3 Microsoft Word 2003 SP2 + Microsoft Office 2003 SP1 + Microsoft Office 2003 SP1 + Microsoft Office 2003 0 + Microsoft Office 2003 0 Microsoft Word 2003 SP1 + Microsoft Office 2003 SP1 + Microsoft Office 2003 SP1 + Microsoft Office 2003 0 + Microsoft Office 2003 0 Microsoft Word 2002 SP3 Microsoft Word 2002 SP2 + Microsoft Office XP SP2 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional Microsoft Word 2002 SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Terminal Server 4.0 SP6 - Microsoft Windows NT Terminal Server 4.0 SP5 - Microsoft Windows NT Terminal Server 4.0 SP4 - Microsoft Windows NT Terminal Server 4.0 SP3 - Microsoft Windows NT Terminal Server 4.0 SP2 - Microsoft Windows NT Terminal Server 4.0 SP1 - Microsoft Windows NT Terminal Server 4.0 alpha - Microsoft Windows NT Terminal Server 4.0 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional Microsoft Open XML File Format Converter for Mac 0 Microsoft Office Compatibility Pack 2007 SP2 Microsoft Office Compatibility Pack 2007 SP1 Microsoft Office Compatibility Pack 2007 0 Microsoft Office 2008 for Mac 0 Microsoft Office 2004 for Mac 0
Not Vulnerable:

Microsoft Word Record RTF Parsing Engine Remote Heap Buffer Overflow Vulnerability

Microsoft Word is prone to a remote heap-based buffer-overflow vulnerability because the application fails to perform adequate boundary-checks on user-supplied data.

An attacker can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely result in denial-of-service conditions.

Microsoft Word Record RTF Parsing Engine Remote Heap Buffer Overflow Vulnerability

A working commercial exploit is available through VUPEN Security - Exploit and PoCs Service. This exploit is not otherwise publicly available or known to be circulating in the wild.

Microsoft Word Record RTF Parsing Engine Remote Heap Buffer Overflow Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the referenced advisory for details.


Microsoft Open XML File Format Converter for Mac 0

• Microsoft Open XML File Format Converter for Mac 1.1.6
  http://www.microsoft.com/downloads/details.aspx?FamilyID=a7b834a3-5a44 -42d4-afe9-6ef207333834

Microsoft Word 2003 SP3

• Microsoft Security Update for Microsoft Office Word 2003 (KB2251399)
  http://www.microsoft.com/downloads/details.aspx?familyid=4360bcec-0731 -4d4a-89eb-7d28a4607f06

Microsoft Office 2008 for Mac 0

• Microsoft Microsoft Office 2008 for Mac 12.2.6 Update
  http://www.microsoft.com/downloads/details.aspx?FamilyID=6ece112f-0ca7 -4b1f-ad20-603950edee66

Microsoft Word 2007 SP2

• Microsoft Security Update for Microsoft Office Word 2007 (KB2251419)
  http://www.microsoft.com/downloads/details.aspx?familyid=0d7210a3-662e -41e7-affc-ae94f9d89388

Microsoft Office 2004 for Mac 0

• Microsoft Microsoft Office 2004 for Mac 11.6.0 Update
  http://www.microsoft.com/downloads/details.aspx?FamilyID=d2f44d4a-7cd8 -4514-b3ff-1770bc47d595

Microsoft Office Compatibility Pack 2007 SP2

• Microsoft Security Update for the 2007 Microsoft Office System (KB2277947)
  http://www.microsoft.com/downloads/details.aspx?familyid=ed5b9671-651d -41f3-aed3-93ee8a28657f

Microsoft Word 2002 SP3

• Microsoft Security Update for Microsoft Word 2002 (KB2251389)
  http://www.microsoft.com/downloads/details.aspx?familyid=978eb887-25b6 -4dde-a2ec-d2d1e7f1a434

Microsoft Word Record RTF Parsing Engine Remote Heap Buffer Overflow Vulnerability

References:

• Microsoft Word Homepage (Microsoft )
  
• Microsoft Word RTF File Parsing Heap Buffer Overflow Vulnerability (iDefense Labs)
  
• Microsoft Security Bulletin MS10-056 (Microsoft)