CERT-In Vulnerability Note
CIVN-2010-0247
Multiple Remote code Execution Vulnerabilities in Microsoft Office
Original Issue Date:November 10, 2010
Severity Rating: HIGH
Systems Affected
- Microsoft Office XP Service Pack 3
- Microsoft Office 2003 Service Pack 3
- Microsoft Office 2007 Service Pack 2
- Microsoft Office 2010 (32-bit editions)
- Microsoft Office 2010 (64-bit editions)
- Microsoft Office for Mac
- Microsoft Office 2004 for Mac
- Microsoft Office 2008 for Mac
- Microsoft Office for Mac 2011
- Open XML File Format Converter for Mac
Overview
Multiple vulnerabilities have been reported in Microsoft Office, which could allow a remote attacker to execute an arbitrary code and take complete control of the affected system in the context of logged in user.
Description
1. Microsoft Office Rich Text Format Content Processing Buffer Overflow Vulnerability
(
CVE-2010-3333
)
A Remote code execution vulnerability exists in the Microsoft office due to improper boundary restrictions when processing malformed Rich Text Format (RTF) data.
Workaround - Read e-mails in plain text.
- Use Microsoft Office File Block policy to block the opening of RTF documents from unknown or untrusted sources and locations.
2. Microsoft Office Art Drawing Records Processing Arbitrary Code Execution Vulnerability
(
CVE-2010-3334
)
A Remote code execution vulnerability exists in the Microsoft office due to a memory corruption error when processing Office Art Drawing records in Office files
Workaround - Use Microsoft Office File Block policy to block the opening of Office 2003 and earlier documents in Microsoft Word from unknown or untrusted sources and locations.
- Use Microsoft Office File Block policy to block the opening of Office 2003 and earlier documents in Microsoft Excel from unknown or untrusted sources and locations.
- Use Microsoft Office File Block policy to block the opening of Office 2003 and earlier documents in Microsoft PowerPoint from unknown or untrusted sources and locations.
- Use the Microsoft Office Isolated Conversion Environment (MOICE) when opening files from unknown or untrusted sources.
3. Microsoft Office Drawing Exception Handling Memory Corruption Vulnerability
(
CVE-2010-3335
)
A Remote code execution vulnerability exists in the Microsoft office due to a memory corruption error when handling drawing exceptions.
Workaround - Use Microsoft Office File Block policy to block the opening of Office 2003 and earlier documents in Microsoft Word from unknown or untrusted sources and locations.
- Use Microsoft Office File Block policy to block the opening of Office 2003 and earlier documents in Microsoft Excel from unknown or untrusted sources and locations
- Use Microsoft Office File Block policy to block the opening of Office 2003 and earlier documents in Microsoft PowerPoint from unknown or untrusted sources and locations.
- Use the Microsoft Office Isolated Conversion Environment (MOICE) when opening files from unknown or untrusted sources
4. Microsoft Office SPID Processing Arbitrary Code Execution Vulnerability
(
CVE-2010-3336
)
A Remote code execution vulnerability exists in the Microsoft office due to improper processing of malformed SQL process IDs (SPID) within Microsoft Office documents.
Workaround - Do not open Office files that you receive from untrusted sources or that you receive unexpectedly from trusted sources.
5. Microsoft Office Insecure Library Loading Vulnerability
(
CVE-2010-3337
)
A Remote code execution vulnerability exists in the Microsoft office due to insecure library loading when opening Microsoft Office documents. When a file is opened, the file may direct the application to load a malicious library possibly referenced from a remote WebDAV file store.
Workaround - Disable loading of libraries from WebDAV and remote network shares
- Disable the WebClient service
- Block TCP ports 139 and 445 at the firewall
Impact: A remote attacker could exploit this vulnerability by convincing a user to view a malicious Word file.
Successful exploitation of these vulnerabilities could allow a remote attacker to execute arbitrary code with the privileges of the currently logged in user.
Solution
Apply appropriate updates as mentioned in the Microsoft Security Bulletin
MS10-087
Vendor Information
Microsoft
http://www.microsoft.com/technet/security/bulletin/ms10-087.mspx
https://www.microsoft.com/technet/security/bulletin/ms10-nov.mspx
References
Microsoft
http://www.microsoft.com/technet/security/bulletin/ms10-087.mspx
https://www.microsoft.com/technet/security/bulletin/ms10-nov.mspx
Secunia
http://secunia.com/advisories/38521/
SecurityTracker
http://securitytracker.com/alerts/2010/Nov/1024705.html
VUPEN
http://www.vupen.com/english/advisories/2010/2923
Cisco
http://tools.cisco.com/security/center/viewAlert.x?alertId=21716
http://tools.cisco.com/security/center/viewAlert.x?alertId=21717
http://tools.cisco.com/security/center/viewAlert.x?alertId=21718
http://tools.cisco.com/security/center/viewAlert.x?alertId=21719
http://tools.cisco.com/security/center/viewAlert.x?alertId=21720
CVE Name
CVE-2010-3333
CVE-2010-3334
CVE-2010-3335
CVE-2010-3336
CVE-2010-3337
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|