Microsoft Visio Object Memory Corruption (CVE-2011-0092) Remote Code Execution Vulnerability

Bugtraq ID:	46137
Class:	Input Validation Error
CVE:	CVE-2011-0092
Remote:	Yes
Local:	No
Published:	Feb 08 2011 12:00AM
Updated:	Feb 08 2011 06:10PM
Credit:	Xin Ouyang of Palo Alto Networks
Vulnerable:	Microsoft Visio 2007 SP2 Microsoft Visio 2007 SP1 Microsoft Visio 2007 0 Microsoft Visio 2003 Standard Microsoft Visio 2003 Professional Microsoft Visio 2003 SP3 Microsoft Visio 2003 SP2 Microsoft Visio 2003 SP1 Microsoft Visio 2003 Microsoft Visio 2002 Standard SP2 Microsoft Visio 2002 Professional SP2 Microsoft Visio 2002 SP3 Microsoft Visio 2002 SP2 Microsoft Visio 2002 SP1 Microsoft Visio 2002
Not Vulnerable:

Microsoft Visio Object Memory Corruption (CVE-2011-0092) Remote Code Execution Vulnerability

Microsoft Visio is prone to a remote code-execution vulnerability because it fails to adequately handle user-supplied data.

Attackers can exploit this issue to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will result in a denial-of-service condition.

Microsoft Visio Object Memory Corruption (CVE-2011-0092) Remote Code Execution Vulnerability

Currently we are not aware of any exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Microsoft Visio Object Memory Corruption (CVE-2011-0092) Remote Code Execution Vulnerability

Solution:
The vendor has released an advisory and fixes. Please see the references for more information.


Microsoft Visio 2002 Professional SP2

• Microsoft Visio2002-KB2434711-FullFile-ENU.EXE
  http://www.microsoft.com/downloads/details.aspx?familyid=273d8078-0dc7 -43d8-bcae-54c811e49e0e

Microsoft Visio 2002 SP2

• Microsoft Visio2002-KB2434711-FullFile-ENU.EXE
  http://www.microsoft.com/downloads/details.aspx?familyid=273d8078-0dc7 -43d8-bcae-54c811e49e0e

Microsoft Visio 2002 Standard SP2

• Microsoft Visio2002-KB2434711-FullFile-ENU.EXE
  http://www.microsoft.com/downloads/details.aspx?familyid=273d8078-0dc7 -43d8-bcae-54c811e49e0e

Microsoft Visio 2003 SP3

• Microsoft visio2003-KB2434733-FullFile-ENU.exe
  http://www.microsoft.com/downloads/details.aspx?familyid=f1067eaa-d18d -4bff-a02e-1d990c36ca7f

Microsoft Visio 2007 SP2

• Microsoft visio2007-kb2434737-fullfile-x86-glb.exe
  http://www.microsoft.com/downloads/details.aspx?familyid=097a642b-b786 -4724-a907-79f37cded836

Microsoft Visio Object Memory Corruption (CVE-2011-0092) Remote Code Execution Vulnerability

References:

• Visio Homepage (Microsoft)
  
• ZDI-11-063: Microsoft Visio 2007 LZW Stream Decompression Exception Vulnerabilit (ZDI Disclosures )
  
• Microsoft Security Bulletin MS11-008 (Microsoft)
  
• ZDI-11-063: Microsoft Visio 2007 LZW Stream Decompression Exception Vulnerabilit (Zero Day Initiative)