Microsoft Excel Record Format Parsing (CVE-2010-3232) Remote Code Execution Vulnerability

Bugtraq ID:	43646
Class:	Unknown
CVE:	CVE-2010-3232
Remote:	Yes
Local:	No
Published:	Oct 12 2010 12:00AM
Updated:	Oct 12 2010 12:00AM
Credit:	Omair
Vulnerable:	Microsoft Open XML File Format Converter for Mac 0 Microsoft Office Compatibility Pack 2007 SP2 Microsoft Office Compatibility Pack 2007 SP1 Microsoft Office Compatibility Pack 2007 0 Microsoft Office 2008 for Mac 0 Microsoft Office 2004 for Mac 0 Microsoft Excel Viewer SP2 Microsoft Excel 2007 SP2 Microsoft Excel 2007 SP1 Microsoft Excel 2007 0 Microsoft Excel 2003 SP3 Microsoft Excel 2003 SP2 Microsoft Excel 2003 SP1 + Microsoft Office 2003 SP1 Microsoft Excel 2003 + Microsoft Office 2003 0
Not Vulnerable:

Microsoft Excel Record Format Parsing (CVE-2010-3232) Remote Code Execution Vulnerability

Microsoft Excel is prone to a remote code-execution vulnerability.

Attackers can exploit this issue by enticing an unsuspecting user to open a specially crafted Excel file.

Successful exploits can allow attackers to execute arbitrary code with the privileges of the user running the application. Failed exploit attempts will result in a denial-of-service condition.

Microsoft Excel Record Format Parsing (CVE-2010-3232) Remote Code Execution Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Microsoft Excel Record Format Parsing (CVE-2010-3232) Remote Code Execution Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for details.


Microsoft Open XML File Format Converter for Mac 0

• Microsoft OpenXMLConverter117.dmg
  http://www.microsoft.com/downloads/details.aspx?FamilyID=5c759c46-ead3 -44ea-b7c8-a308b3140d2e

Microsoft Office 2008 for Mac 0

• Microsoft Office2008-1227UpdateEN.dmg
  http://www.microsoft.com/downloads/details.aspx?FamilyID=abd05074-8ffc -41a4-a2f3-1d8047574552

Microsoft Excel 2007 SP2

• Microsoft excel2007-kb2345035-fullfile-x86-glb.exe
  http://www.microsoft.com/downloads/details.aspx?familyid=dc9b9af5-50b0 -4a07-8923-a30fd5548760

Microsoft Office 2004 for Mac 0

• Microsoft Office2004-1161UpdateEN.dmg
  http://www.microsoft.com/downloads/details.aspx?FamilyID=464965fa-971a -49dd-bcee-c4d91fac86a9

Microsoft Excel 2003 SP3

• Microsoft office2003-KB2344893-FullFile-ENU.exe
  http://www.microsoft.com/downloads/details.aspx?familyid=3d9a00b8-0f80 -4d36-b92a-89b61350fb36

Microsoft Office Compatibility Pack 2007 SP2

• Microsoft Office2007-kb2344875-fullfile-x86-glb.exe
  http://www.microsoft.com/downloads/details.aspx?familyid=7391ec2f-12c9 -483c-91d8-e3ec5754da1c

Microsoft Excel Viewer SP2

• Microsoft Office-kb2345088-fullfile-x86-glb.exe
  http://www.microsoft.com/downloads/details.aspx?familyid=a833a94a-2dc0 -4864-9c14-e196dc54c5a7

Microsoft Excel Record Format Parsing (CVE-2010-3232) Remote Code Execution Vulnerability

References:

• Microsoft Excel Homepage (Microsoft )
  
• Microsoft Security Bulletin MS10-080 (Microsoft)