Microsoft Publisher '.pub' File 'pubconv.dll' Memory Corruption Remote Code Execution Vulnerability

Bugtraq ID:	50090
Class:	Input Validation Error
CVE:	CVE-2011-1508
Remote:	Yes
Local:	No
Published:	Oct 12 2011 12:00AM
Updated:	Dec 13 2011 07:48PM
Credit:	Daniel Kazimirow of Core Security Technologies
Vulnerable:	Microsoft Publisher 2007 SP3 0 Microsoft Publisher 2007 SP2 Microsoft Publisher 2007 SP1 Microsoft Publisher 2007 0 Microsoft Publisher 2003 SP3 Microsoft Publisher 2003 SP2 Microsoft Publisher 2003
Not Vulnerable:

Microsoft Publisher '.pub' File 'pubconv.dll' Memory Corruption Remote Code Execution Vulnerability

Microsoft Publisher is prone to a remote code-execution vulnerability.

An attacker can exploit this issue by enticing an unsuspecting user into opening a specially crafted '.pub' file.

Successfully exploiting this issue allows attackers to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will result in a denial-of-service condition.

Microsoft Publisher '.pub' File 'pubconv.dll' Memory Corruption Remote Code Execution Vulnerability

Proof-of-concept code was developed by CORE Security Technologies. This proof-of-concept is not known to be publicly available.

Microsoft Publisher '.pub' File 'pubconv.dll' Memory Corruption Remote Code Execution Vulnerability

Solution:
The vendor released an update to address this issue. Please see the references for more information.

Microsoft Publisher '.pub' File 'pubconv.dll' Memory Corruption Remote Code Execution Vulnerability

References:

• Microsoft Publisher 2007 Pubconv.dll Memory Corruption (Core Security Technologies)
  
• Publisher Homepage (Microsoft)
  
• Microsoft Security Bulletin MS11-091 - Important (Microsoft)