Microsoft Office PNG File CVE-2013-1331 Buffer Overflow Vulnerability

Bugtraq ID:	60408
Class:	Boundary Condition Error
CVE:	CVE-2013-1331
Remote:	Yes
Local:	No
Published:	Jun 11 2013 12:00AM
Updated:	Jun 21 2013 01:20PM
Credit:	Andrew Lyons and Neel Mehta of Google Inc
Vulnerable:	Microsoft Office 2011 for Mac 0 Microsoft Office 2003 SP2 Microsoft Office 2003 SP1 Microsoft Office 2003 0 + Microsoft Excel 2003 + Microsoft FrontPage 2003 + Microsoft InfoPath 2003 + Microsoft OneNote 2003 0 + Microsoft Outlook 2003 0 + Microsoft PowerPoint 2003 0 + Microsoft Publisher 2003
Not Vulnerable:

Microsoft Office PNG File CVE-2013-1331 Buffer Overflow Vulnerability

Microsoft Office is prone to a remote stack-based buffer-overflow vulnerability because the software fails to perform adequate boundary checks on user-supplied data.

An attacker can exploit this issue by enticing a victim to open a malicious PNG file.

Successfully exploiting this issue would allow the attacker to corrupt memory and execute arbitrary code in the context of the currently logged-in user.

Microsoft Office PNG File CVE-2013-1331 Buffer Overflow Vulnerability

Reports indicate that this issue has been exploited in the wild in targeted zero day attacks.

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

Microsoft Office PNG File CVE-2013-1331 Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Microsoft Office PNG File CVE-2013-1331 Buffer Overflow Vulnerability

References:

• Microsoft Office Product Homepage (Microsoft)