Microsoft Excel Buffer Overflow CVE-2011-1276 Remote Code Execution Vulnerability

Bugtraq ID:	48161
Class:	Boundary Condition Error
CVE:	CVE-2011-1276
Remote:	Yes
Local:	No
Published:	Jun 14 2011 12:00AM
Updated:	Aug 10 2011 10:20PM
Credit:	Nicolas Gregoire of Agarri, working with VeriSign iDefense Labs
Vulnerable:	Microsoft Open XML File Format Converter for Mac 0 Microsoft Office Compatibility Pack 2007 SP2 Microsoft Office Compatibility Pack 2007 SP1 Microsoft Office Compatibility Pack 2007 0 Microsoft Office 2008 for Mac 0 Microsoft Office 2004 for Mac 0 Microsoft Excel Viewer SP2 Microsoft Excel Viewer SP1 Microsoft Excel Viewer 0 Microsoft Excel 2007 SP2 Microsoft Excel 2007 SP1 Microsoft Excel 2007 0 Microsoft Excel 2003 SP3 Microsoft Excel 2003 SP2 Microsoft Excel 2003 SP1 + Microsoft Office 2003 SP1 Microsoft Excel 2003 + Microsoft Office 2003 0 Microsoft Excel 2002 SP3 + Microsoft Office XP SP3 Microsoft Excel 2002 SP2 + Microsoft Office XP SP2 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional Microsoft Excel 2002 SP1 + Microsoft Office XP SP1 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Terminal Server 4.0 SP6 - Microsoft Windows NT Terminal Server 4.0 SP5 - Microsoft Windows NT Terminal Server 4.0 SP4 - Microsoft Windows NT Terminal Server 4.0 SP3 - Microsoft Windows NT Terminal Server 4.0 SP2 - Microsoft Windows NT Terminal Server 4.0 SP1 - Microsoft Windows NT Terminal Server 4.0 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional Microsoft Excel 2002 + Microsoft Office XP - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 SR2 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0
Not Vulnerable:

Microsoft Excel Buffer Overflow CVE-2011-1276 Remote Code Execution Vulnerability

Microsoft Excel is prone to a remote code-execution vulnerability due to a buffer-overflow error.

Attackers can exploit this issue by enticing an unsuspecting user to open a specially crafted Excel file.

Successful exploits may allow attackers to execute arbitrary code with the privileges of the user running the affected application. Failed exploit attempts will likely result in a denial-of-service condition.

Microsoft Excel Buffer Overflow CVE-2011-1276 Remote Code Execution Vulnerability

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

The following proof-of-concept is available:

• /data/vulnerabilities/exploits/48161.py

Microsoft Excel Buffer Overflow CVE-2011-1276 Remote Code Execution Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for details.


Microsoft Office 2008 for Mac 0

• Microsoft Microsoft Office 2008 for Mac 12.3.0 Update
  http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=26 353

Microsoft Excel 2003 SP3

• Microsoft Security Update for Microsoft Office Excel 2003 (KB2541025)
  http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=26 316

Microsoft Office Compatibility Pack 2007 SP2

• Microsoft Security Update for the 2007 Microsoft Office System (KB2541012)
  http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=26 341

Microsoft Open XML File Format Converter for Mac 0

• Microsoft Open XML File Format Converter for Mac 1.2.0
  http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=26 342

Microsoft Excel 2007 SP2

• Microsoft Security Update for Microsoft Office Excel 2007 (KB2541007)
  http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=26 475

Microsoft Excel 2002 SP3

• Microsoft Security Update for Microsoft Excel 2002 (KB2541003)
  http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=26 299

Microsoft Office 2004 for Mac 0

• Microsoft Microsoft Office 2004 for Mac 11.6.4 Update
  http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=26 350

Microsoft Excel Viewer SP2

• Microsoft Security Update for Microsoft Office Excel Viewer (KB2541015)
  http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=26 297

Microsoft Excel Buffer Overflow CVE-2011-1276 Remote Code Execution Vulnerability

References:

• Microsoft Excel Homepage (Microsoft )
  
• Microsoft Excel SLK File Font Parsing Stack Buffer Overflow Vulnerability (iDefense)
  
• Microsoft Security Bulletin MS11-045 - Important (Microsoft)