Microsoft Office Memory Corruption CVE-2012-2524 Remote Code Execution Vulnerability

Bugtraq ID:	54876
Class:	Unknown
CVE:	CVE-2012-2524
Remote:	Yes
Local:	No
Published:	Aug 14 2012 12:00AM
Updated:	Aug 14 2012 12:00AM
Credit:	Andrei Costin
Vulnerable:	Microsoft Office 2010 (64-bit edition) SP1 Microsoft Office 2010 (32-bit edition) SP1 Microsoft Office 2007 SP3 Microsoft Office 2007 SP2
Not Vulnerable:

Microsoft Office Memory Corruption CVE-2012-2524 Remote Code Execution Vulnerability

Microsoft Office is prone to a remote code-execution vulnerability due to a memory-corruption error.

Attackers can exploit this issue by enticing an unsuspecting user to open a specially crafted Computer Graphics Metafile (CGM) graphics file.

Successful exploits may allow attackers to execute arbitrary code with the privileges of the user running the affected application. Failed exploit attempts will likely result in a denial-of-service condition.

Microsoft Office Memory Corruption CVE-2012-2524 Remote Code Execution Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Microsoft Office Memory Corruption CVE-2012-2524 Remote Code Execution Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for details.

Microsoft Office Memory Corruption CVE-2012-2524 Remote Code Execution Vulnerability

References:

• Microsoft Office Product Homepage (Microsoft)
  
• Microsoft Security Bulletin MS12-057 (Microsoft)