CERT-In Vulnerability Note
CIVN-2011-0182
Microsoft Office Remote Code Execution Vulnerability
Original Issue Date:December 14, 2011
Severity Rating: HIGH
Component Affected
- Microsoft Office Suites and Components
- Microsoft Office 2007 Service Pack 2
- Microsoft Office 2007 Service Pack 3
- Microsoft Office 2010 and Microsoft Office 2010 Service Pack 1 (32-bit editions)
- Microsoft Office 2010 and Microsoft Office 2010 Service Pack 1 (64-bit editions)
- Microsoft Office for Mac
- Microsoft Office for Mac 2011
Overview
A vulnerability has been reported in Microsoft office which could allow a remote attacker to execute arbitrary code on the affected system.
Description
This vulnerability is caused due to improper handling of a specific property contained in the border element of a Microsoft Word document. The affected application could incorrectly frees the memory assigned while processing this word document property. Due to this, a use-after-free condition could occurs if another object tries to access the memory location.
An unauthenticated, remote attacker could exploit this vulnerability by enticing users to open a malicious crafted Microsoft Word document. Memory corruption condition could occurs while processing the crafted malicious document. Successful exploitation of this vulnerability could allow attacker to execute arbitrary code on the system with the privileges of currently logged-in user.
Workaround
- Use Limited privileged user
- Protect yourself against social engineering attacks
- Do not open Office files that you receive from untrusted sources or that you receive unexpectedly from trusted sources
Solution
Apply appropriate patches as mentioned in Microsoft Security Bulletin
MS11-089
Vendor Information
Microsoft
http://technet.microsoft.com/en-us/security/bulletin/ms11-089
References
SecurityFocus
http://www.securityfocus.com/bid/50956
Zero day Initiative
http://www.zerodayinitiative.com/advisories/ZDI-11-347/
CISCO
http://tools.cisco.com/security/center/viewAlert.x?alertId=24714
CVE Name
CVE-2011-1983
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|