CERT-In Vulnerability Note
CIVN-2010-0266
Microsoft Office Publisher Multiple Code Execution Vulnerabilities
Original Issue Date:December 15, 2010
Severity Rating: MEDIUM
Systems Affected
- Microsoft Publisher 2002 Service Pack 3
- Microsoft Publisher 2003 Service Pack 3
- Microsoft Publisher 2007 Service Pack 2
- Microsoft Publisher 2010 (32-bit editions)
- Microsoft Publisher 2010 (64-bit editions)
- Microsoft Office XP Service Pack 3
- Microsoft Office 2003 Service Pack 3
- Microsoft Office 2007 Service Pack 2
- Microsoft Office 2010 (32-bit editions)
- Microsoft Office 2010 (64-bit editions)
Overview
Five vulnerabilities have been reported in Microsoft Office Publisher, which could be exploited by attackers to compromise a vulnerable system. These issues are caused by buffer overflows, memory corruptions and array indexing errors when processing malformed Publisher files, which could be exploited by attackers to execute arbitrary code by tricking a user into opening a malicious document.
Description
1. Size Value Heap Corruption in pubconv.dll Vulnerability
(
CVE-2010-2569
)
This vulnerability exists due to insufficient boundary restrictions during the conversion of Publisher files. An unauthenticated, remote attacker could exploit this vulnerability by convincing a user to view a malicious document.
2. Heap Overrun in pubconv.dll Vulnerability
(
CVE-2010-2570
)
This vulnerability exists due to improper processing of malformed Publisher files. An unauthenticated, remote attacker could exploit this vulnerability by convincing a user to view a malicious document.
3. Memory Corruption Due To Invalid Index Into Array in Pubconv.dll Vulnerability
(
CVE-2010-2571
)
This vulnerability exists due to improper processing of array index values within Publisher files. An unauthenticated, remote attacker could exploit this vulnerability by convincing a user to view a malicious document.
4. Microsoft Publisher Memory Corruption Vulnerability
(
CVE-2010-3954
)
This vulnerability exists due to improper parsing of malformed Publisher documents. An unauthenticated, remote attacker could exploit this vulnerability by convincing a user to view a malicious document.
5. Array Indexing Memory Corruption Vulnerability
(
CVE-2010-3955
)
The vulnerability exists due to improper handling of array indexes within Publisher documents. An unauthenticated, remote attacker could exploit this vulnerability by convincing a user to view a malicious document.
Workaround
- Disable the Publisher Converter DLL
- Do not open Office files that received from untrusted sources or received unexpectedly from trusted sources
For detailed steps and impact of applying these workarounds refer to Microsoft Security bulletin MS10-103
Solution
Apply patches as mentioned in Microsoft Security bulletin
MS10-103
Vendor Information
Microsoft
http://www.microsoft.com/technet/security/bulletin/ms10-103.mspx
References
Microsoft
http://www.microsoft.com/technet/security/bulletin/ms10-103.mspx
Cisco
http://www.cisco.com/web/about/security/intelligence/ERP_dec10.html
Vupen
http://www.vupen.com/english/advisories/2010/3225
Secunia
http://secunia.com/advisories/42630
Security Tracker
http://securitytracker.com/alerts/2010/Dec/1024885.html
CVE Name
CVE-1010-2569
CVE-2010-2570
CVE-2010-2571
CVE-2010-3954
CVE-2010-3955
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|