Microsoft Office Art Drawing Record Remote Code Execution Vulnerability

Bugtraq ID:	44656
Class:	Unknown
CVE:	CVE-2010-3334
Remote:	Yes
Local:	No
Published:	Nov 09 2010 12:00AM
Updated:	Dec 15 2010 09:54PM
Credit:	Dyon Balding, Secunia Research
Vulnerable:	Microsoft Open XML File Format Converter for Mac 0 Microsoft Office XP SP3 + Microsoft Excel 2002 SP3 + Microsoft Excel 2002 SP3 + Microsoft FrontPage 2002 SP3 + Microsoft FrontPage 2002 SP3 + Microsoft Outlook 2002 SP3 + Microsoft Outlook 2002 SP3 + Microsoft PowerPoint 2002 SP3 + Microsoft PowerPoint 2002 SP3 + Microsoft Publisher 2002 SP3 + Microsoft Publisher 2002 SP3 Microsoft Office XP SP2 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional Microsoft Office XP SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional Microsoft Office XP - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional Microsoft Office 2010 (64-bit edition) 0 Microsoft Office 2010 (32-bit edition) 0 Microsoft Office 2010 0 Microsoft Office 2008 for Mac 0 Microsoft Office 2007 SP2 Microsoft Office 2007 SP1 Microsoft Office 2007 0 + Microsoft Access 2007 0 + Microsoft Access 2007 0 + Microsoft Excel 2003 + Microsoft Excel 2007 0 + Microsoft Excel 2007 0 + Microsoft FrontPage 2003 + Microsoft Groove 2007 0 + Microsoft Groove 2007 0 + Microsoft InfoPath 2003 + Microsoft InfoPath 2007 0 + Microsoft InfoPath 2007 0 + Microsoft Office Communicator 2007 0 + Microsoft Office Communicator 2007 0 + Microsoft OneNote 2003 0 + Microsoft Outlook 2003 0 + Microsoft Outlook 2007 0 + Microsoft Outlook 2007 0 + Microsoft PowerPoint 2003 0 + Microsoft PowerPoint 2007 0 + Microsoft PowerPoint 2007 0 + Microsoft Project Professional 2007 0 + Microsoft Project Professional 2007 0 + Microsoft Project Standard 2007 0 + Microsoft Project Standard 2007 0 + Microsoft Publisher 2003 + Microsoft Publisher 2007 0 + Microsoft Publisher 2007 0 + Microsoft SharePoint Designer 2007 0 + Microsoft SharePoint Designer 2007 0 + Microsoft Visio Professional 2007 0 + Microsoft Visio Professional 2007 0 + Microsoft Visio Standard 2007 0 + Microsoft Visio Standard 2007 0 Microsoft Office 2004 for Mac 0 Microsoft Office 2003 SP2 Microsoft Office 2003 SP1 Microsoft Office 2003 0 + Microsoft Excel 2003 + Microsoft FrontPage 2003 + Microsoft InfoPath 2003 + Microsoft OneNote 2003 0 + Microsoft Outlook 2003 0 + Microsoft PowerPoint 2003 0 + Microsoft Publisher 2003
Not Vulnerable:

Microsoft Office Art Drawing Record Remote Code Execution Vulnerability

Microsoft Office is prone to a remote code-execution vulnerability.

An attacker could exploit this issue by enticing a victim to open a malicious Office file.

Successfully exploiting this issue would allow the attacker to corrupt memory and execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will result in a denial-of-service condition.

Microsoft Office Art Drawing Record Remote Code Execution Vulnerability

A commercial proof of concept is available through VUPEN Security - Exploit and PoCs Service. This proof of concept is not otherwise publicly
available or known to be circulating in the wild.

Microsoft Office Art Drawing Record Remote Code Execution Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for more information.


Microsoft Office 2008 for Mac 0

• Microsoft Office2008-1228UpdateEN.dmg
  https://www.microsoft.com/downloads/en/details.aspx?FamilyID=ad1b1984- b2b2-49b3-a1dd-385b77d9248a&displaylang=en#Overview

Microsoft Office XP SP3

• Microsoft officexp-KB2289169-FullFile-ENU.exe
  http://www.microsoft.com/downloads/details.aspx?FamilyId=F32648E3-2FB5 -472C-932F-360E5D3C0931

Microsoft Office 2007 SP2

• Microsoft Office2007-kb2289158-fullfile-x86-glb.exe
  http://www.microsoft.com/downloads/details.aspx?familyid=be0c5878-60c0 -4700-8836-50d369b51d04

Microsoft Office 2010 (64-bit edition) 0

• Microsoft Office2010-kb2289161-fullfile-x64-glb.exe
  http://www.microsoft.com/downloads/details.aspx?familyid=534c6a2a-e7c6 -4adf-8b81-e009a2b5fff4

Microsoft Office 2010 (32-bit edition) 0

• Microsoft Office2010-kb2289161-fullfile-x86-glb.exe
  http://www.microsoft.com/downloads/details.aspx?familyid=0b308508-0e1e -4e90-b2b8-7e32bfc5dbf4

Microsoft Office Art Drawing Record Remote Code Execution Vulnerability

References:

• Microsoft Office Drawing Shape Container Parsing Vulnerability (Secunia)
  
• Microsoft Office Product Homepage (Microsoft)
  
• 2476512 Description of the Office 2008 for Mac 12.2.8 Update (Microsoft)
  
• Microsoft Security Bulletin MS10-087 (Microsoft)