CERT-In Vulnerability Note
CIVN-2010-0150
Microsoft Office COM Validation Code Execution Vulnerability
Original Issue Date:June 10, 2010
Updated: October 15, 2010
Severity Rating: HIGH
Systems Affected
- Microsoft Office XP Service Pack 3
- Microsoft Office 2003 Service Pack 3
- Microsoft Office 2007 System Service Pack 1 and Service
Pack 2
Component Affected
- Microsoft Office Excel 2003 Service Pack 3
- Microsoft Office PowerPoint 2003 Service Pack 3
- Microsoft Office Publisher 2003 Service Pack 3
- Microsoft Office Visio 2003 Service Pack 3
- Microsoft Office Word 2003 Service Pack 3
- Microsoft Office Excel 2007 Service Pack 1 & 2
- Microsoft Office PowerPoint 2007 Service Pack 1 & 2
- Microsoft Office Publisher 2007 Service Pack 1 & 2
- Microsoft Office Visio 2007 Service Pack 1 & 2
- Microsoft Office Word 2007 Service Pack 1 & 2
Overview
A remote code execution vulnerability has been reported in Microsoft office COM Component Object Model object. Successful exploitation of this vulnerability could allow an attacker to execute an arbitrary code and take complete control of the affected system in the context of logged in user.
Description
Microsoft COM Component Object Model technology in the Microsoft Windows Operating System enables software components to communicate. COM is used by developers to create re-usable software components, link components together to build applications, and take advantage of Windows services.
This vulnerability is due to improper validation of COM in Microsoft Office file and persuade user to open the same. Successful exploitation of this vulnerability could allow remote attacker to execute arbitrary code and take control of the vulnerable system with the context of logged in user.
Workaround
- Do not open or save Microsoft Office files received from un-trusted sources.
Solution
Apply appropriate updates as mentioned in the Microsoft Security Bulletin
MS10-036
and Microsoft Security bulletin
MS10-083
Vendor Information
Microsoft
http://www.microsoft.com/technet/security/bulletin/ms10-036.mspx
http://www.microsoft.com/technet/security/bulletin/ms10-083.mspx
References
Microsoft
http://www.microsoft.com/technet/security/bulletin/ms10-036.mspx
http://www.microsoft.com/technet/security/bulletin/ms10-083.mspx
ISS Xforce
http://xforce.iss.net/xforce/xfdb/58862
http://xforce.iss.net/xforce/xfdb/62133
Vupen
http://www.vupen.com/english/advisories/2010/1393
http://www.vupen.com/english/advisories/2010/2630
CVE Name
CVE-2010-1263
Disclaimer
All security alerts sent by CERT-In through the email account advisory@cert-in.org.in are signed by key Id: 0x6CA13DF4
Contact Information
Email: info@cert-in.org.in
Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|