Microsoft Excel CVE-2011-3403 Remote Code Execution Vulnerability

Bugtraq ID:	50954
Class:	Unknown
CVE:	CVE-2011-3403
Remote:	Yes
Local:	No
Published:	Dec 13 2011 12:00AM
Updated:	Dec 21 2011 09:39AM
Credit:	An anonymous researcher, working with VeriSign iDefense Labs.
Vulnerable:	Microsoft Office 2004 for Mac 0 Microsoft Excel 2003 SP3
Not Vulnerable:

Microsoft Excel CVE-2011-3403 Remote Code Execution Vulnerability

Microsoft Excel is prone to a remote code-execution vulnerability due to a memory-corruption error.

Attackers can exploit this issue by enticing an unsuspecting user to open a specially crafted Excel file.

Successful exploits may allow attackers to execute arbitrary code with the privileges of the user running the affected application. Failed exploit attempts will likely result in a denial-of-service condition.

Microsoft Excel CVE-2011-3403 Remote Code Execution Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Microsoft Excel CVE-2011-3403 Remote Code Execution Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for details.


Microsoft Excel 2003 SP3

• Microsoft Security Update for Microsoft Office Excel 2003 (KB2596954)
  http://www.microsoft.com/downloads/details.aspx?familyid=5859014f-afc5 -4958-82ea-6ba45a5ad4b3

Microsoft Office 2004 for Mac 0

• Microsoft Microsoft Office 2004 for Mac 11.6.6 Update
  http://www.microsoft.com/downloads/details.aspx?FamilyID=ef3b559c-0bd2 -45dd-8049-6946f6431a2a

Microsoft Excel CVE-2011-3403 Remote Code Execution Vulnerability

References:

• Microsoft Excel Homepage (Microsoft )
  
• Microsoft Security Bulletin MS11-096 (Microsoft)