CERT-In Vulnerability Note
CIVN-2010-0248
Microsoft Office PowerPoint Remote Code Execution Vulnerabilities
Original Issue Date:November 10, 2010
Severity Rating: MEDIUM
Systems Affected
- Microsoft Office 2003 Professional Edition
- Microsoft Office 2003 Small Business Edition
- Microsoft Office 2003 Standard Edition
- Microsoft Office 2003 Student and Teacher Edition
- Microsoft Office PowerPoint Viewer 2007
- Microsoft Office XP
- Microsoft PowerPoint 2002
- Microsoft Power point 2003
Overview
Two vulnerabilities have been reported in Microsoft Windows PowerPoint which could be exploited by the attacker to compromise the affected system in the context of logged in user.
Description
1. PowerPoint PP7X32.DLL Record Parsing Vulnerability
(
CVE-2010-2572
)
A remote code execution vulnerability exists in Microsoft PowerPoint PP7X32.DLL while processing certain records in PowerPoint 95 files. An attacker could exploit this vulnerability by creating a specially crafted power point 95 file and persuade user to open the same. Opening this file can cause heap overflow .Successful exploitation of this vulnerability could allow remote attacker to execute arbitrary code and can take complete control of an affected system.
Workaround - Restrict access to pp7x32.dll for users of Microsoft PowerPoint 2002.
- Use Microsoft Office File Block policy to block the opening of Office 2003 that receives from untrusted sources.
- Use the Microsoft Office Isolated Conversion Environment (MOICE) when opening files that receives from untrusted sources.
- Do not open PowerPoint files that receives from untrusted sources.
2. PowerPoint Unknown Animation Node Remote Code Execution Vulnerability
(
CVE-2010-2573
)
A remote code execution vulnerability exists in Microsoft PowerPoint while processing documents in PowerPoint files. The specific flaw exists within the application trusting a value defined within a file. This value will have some arithmetic performed on it, and subsequently be used as a counter for a processing loop. An attacker could exploit this vulnerability by creating a specially crafted power point file and persuade user to open the same. Successful exploitation of this vulnerability could allow remote attacker to execute arbitrary code and can take complete control of an affected system.
Workaround - Use Microsoft Office File Block policy to block the opening of Office 2003 that receives from untrusted sources.
- Use the Microsoft Office Isolated Conversion Environment (MOICE) when opening files that receives from untrusted sources.
- Do not open PowerPoint files that receives from untrusted sources.
Solution
Apply appropriate updates as mentioned in the Microsoft Security Bulletin
MS10-088
Vendor Information
Microsoft
http://www.microsoft.com/technet/security/bulletin/ms10-088.mspx
References
Microsoft
http://www.microsoft.com/technet/security/bulletin/ms10-088.mspx
Secunia
http://secunia.com/advisories/39304
http://secunia.com/secunia_research/2010-61/
Zero Day initiative
http://www.zerodayinitiative.com/advisories/ZDI-10-245/
AUS- CERT
http://auscert.org/render.html?it=13585
Security Tracker
http://securitytracker.com/alerts/2010/Nov/1024706.html
Vupen
http://www.vupen.com/english/advisories/2010/2924
Security focus
http://www.securityfocus.com/bid/44628
CVE Name
CVE-2010-2572
CVE-2010-2573
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|