Microsoft Office RTF File Stack Buffer Overflow Vulnerability

Bugtraq ID:	44652
Class:	Boundary Condition Error
CVE:	CVE-2010-3333
Remote:	Yes
Local:	No
Published:	Nov 09 2010 12:00AM
Updated:	Apr 19 2012 11:50AM
Credit:	team509 working with VeriSign iDefense Labs
Vulnerable:	Microsoft Open XML File Format Converter for Mac 0 Microsoft Office XP SP3 + Microsoft Excel 2002 SP3 + Microsoft Excel 2002 SP3 + Microsoft FrontPage 2002 SP3 + Microsoft FrontPage 2002 SP3 + Microsoft Outlook 2002 SP3 + Microsoft Outlook 2002 SP3 + Microsoft PowerPoint 2002 SP3 + Microsoft PowerPoint 2002 SP3 + Microsoft Publisher 2002 SP3 + Microsoft Publisher 2002 SP3 Microsoft Office XP SP2 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional Microsoft Office XP SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional Microsoft Office XP - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional Microsoft Office 2011 for Mac 0 Microsoft Office 2010 (64-bit edition) 0 Microsoft Office 2010 (32-bit edition) 0 Microsoft Office 2010 0 Microsoft Office 2008 for Mac 0 Microsoft Office 2007 SP2 Microsoft Office 2007 SP1 Microsoft Office 2007 0 + Microsoft Access 2007 0 + Microsoft Access 2007 0 + Microsoft Excel 2003 + Microsoft Excel 2007 0 + Microsoft Excel 2007 0 + Microsoft FrontPage 2003 + Microsoft Groove 2007 0 + Microsoft Groove 2007 0 + Microsoft InfoPath 2003 + Microsoft InfoPath 2007 0 + Microsoft InfoPath 2007 0 + Microsoft Office Communicator 2007 0 + Microsoft Office Communicator 2007 0 + Microsoft OneNote 2003 0 + Microsoft Outlook 2003 0 + Microsoft Outlook 2007 0 + Microsoft Outlook 2007 0 + Microsoft PowerPoint 2003 0 + Microsoft PowerPoint 2007 0 + Microsoft PowerPoint 2007 0 + Microsoft Project Professional 2007 0 + Microsoft Project Professional 2007 0 + Microsoft Project Standard 2007 0 + Microsoft Project Standard 2007 0 + Microsoft Publisher 2003 + Microsoft Publisher 2007 0 + Microsoft Publisher 2007 0 + Microsoft SharePoint Designer 2007 0 + Microsoft SharePoint Designer 2007 0 + Microsoft Visio Professional 2007 0 + Microsoft Visio Professional 2007 0 + Microsoft Visio Standard 2007 0 + Microsoft Visio Standard 2007 0 Microsoft Office 2004 for Mac 0 Microsoft Office 2003 SP2 Microsoft Office 2003 SP1 Microsoft Office 2003 0 + Microsoft Excel 2003 + Microsoft FrontPage 2003 + Microsoft InfoPath 2003 + Microsoft OneNote 2003 0 + Microsoft Outlook 2003 0 + Microsoft PowerPoint 2003 0 + Microsoft Publisher 2003
Not Vulnerable:

Microsoft Office RTF File Stack Buffer Overflow Vulnerability

Microsoft Office is prone to a remote stack-based buffer-overflow vulnerability because the software fails to perform adequate boundary checks on user-supplied data.

An attacker can exploit this issue by enticing a victim to open a malicious RTF file or view an email in RTF format.

Successfully exploiting this issue would allow the attacker to corrupt memory and execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will result in a denial-of-service condition.

Microsoft Office RTF File Stack Buffer Overflow Vulnerability

A working commercial exploit is available through the VUPEN Security - Exploit and PoCs Service. This exploit is not otherwise publicly available or known to be circulating in the wild.

This issue is actively being exploited in the wild. An exploit from Snake is available at:

http://www.exploit-db.com/sploits/cve-2011-3333_exploit.doc

Symantec has not tested the exploit. Please use caution before opening the above file.

The following exploits are available:

• /data/vulnerabilities/exploits/44652.rb
• /data/vulnerabilities/exploits/44652.py
• /data/vulnerabilities/exploits/44652_1.py

Microsoft Office RTF File Stack Buffer Overflow Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for more information.


Microsoft Office 2008 for Mac 0

• Microsoft Office2008-1228UpdateEN.dmg
  https://www.microsoft.com/downloads/en/details.aspx?FamilyID=ad1b1984- b2b2-49b3-a1dd-385b77d9248a&displaylang=en#Overview

Microsoft Office XP SP3

• Microsoft officexp-KB2289169-FullFile-ENU.exe
  http://www.microsoft.com/downloads/details.aspx?FamilyId=F32648E3-2FB5 -472C-932F-360E5D3C0931

Microsoft Office 2007 SP2

• Microsoft Office2007-kb2289158-fullfile-x86-glb.exe
  http://www.microsoft.com/downloads/details.aspx?familyid=be0c5878-60c0 -4700-8836-50d369b51d04

Microsoft Office 2010 (64-bit edition) 0

• Microsoft Office2010-kb2289161-fullfile-x64-glb.exe
  http://www.microsoft.com/downloads/details.aspx?familyid=534c6a2a-e7c6 -4adf-8b81-e009a2b5fff4

Microsoft Office 2011 for Mac 0

• Microsoft Office2011-1401UpdateEN.dmg
  http://www.microsoft.com/downloads/details.aspx?FamilyID=8bd6ca3b-8004 -4e8d-a09d-220dcbbce799

Microsoft Office 2010 (32-bit edition) 0

• Microsoft Office2010-kb2289161-fullfile-x86-glb.exe
  http://www.microsoft.com/downloads/details.aspx?familyid=0b308508-0e1e -4e90-b2b8-7e32bfc5dbf4

Microsoft Office RTF File Stack Buffer Overflow Vulnerability

References:

• Microsoft Office Product Homepage (Microsoft)
  
• Microsoft Word RTF File Parsing Stack Buffer Overflow Vulnerability (iDefense Labs)
  
• iDefense Security Advisory 11.09.10: Microsoft Word RTF File Parsing Stack Buffe (iDefense Labs )
  
• 2476512 Description of the Office 2008 for Mac 12.2.8 Update (Microsoft)
  
• Microsoft Security Bulletin MS10-087 (Microsoft)
  
• Microsoft Word RTF File Parsing Stack Buffer Overflow Vulnerability (iDefense Labs)