Secunia Advisory SA35115

Microsoft Office PowerPoint Multiple Vulnerabilities
Secunia Advisory SA35115
Release Date 2010-02-09
Last Update 2010-02-12
   
Popularity 969 views

Criticality level Highly criticalHighly critical
Impact System access
Where From remote
Authentication level Available in Customer Area
   
Report reliability Available in Customer Area
Solution Status Vendor Patch
   
Secunia PoC Available in Customer Area
Secunia analysis Available in Customer Area
   
Systems affected Available in Customer Area
Approve distribution Available in Customer Area
Remediation status Secunia CSI, Secunia PSI
Automated scanning Secunia CSI, Secunia PSI
   
Software:Microsoft Office 2003 Professional Edition
Microsoft Office 2003 Small Business Edition
Microsoft Office 2003 Standard Edition
Microsoft Office 2003 Student and Teacher Edition
Microsoft Office XP
Microsoft PowerPoint 2002.x
Microsoft Powerpoint 2003.x

Secunia CVSS Score Available in Customer Area
CVE Reference(s) CVE-2010-0029 CVSS available in Customer Area
CVE-2010-0030 CVSS available in Customer Area
CVE-2010-0031 CVSS available in Customer Area
CVE-2010-0032 CVSS available in Customer Area
CVE-2010-0033 CVSS available in Customer Area
CVE-2010-0034 CVSS available in Customer Area
  

Description
Multiple vulnerabilities have been reported in Microsoft Office PowerPoint, which can be exploited by malicious people to compromise a user's system.

1) A boundary error when handling file paths can be exploited to cause a stack-based buffer overflow via a specially crafted file.

2) An error in the parsing of LinkedSlideAtom records can be exploited to cause a heap-based buffer overflow via a specially crafted file.

3) An array indexing error in the parsing of the "placementId" field value in OEPlaceholderAtom records can be exploited to corrupt memory via a specially crafted file.

4) A use-after-free error in the parsing of multiple OEPlaceholderAtom records in a "msofbtClientData" container can be exploited to corrupt memory via a specially crafted file.

5) A boundary error in PowerPoint Viewer 2003 when parsing TextBytesAtom records can be exploited to cause a stack-based buffer overflow via a specially crafted file.

6) A boundary error in PowerPoint Viewer 2003 when parsing TextCharsAtom records can be exploited to cause a stack-based buffer overflow via a specially crafted file.

Successful exploitation of the vulnerabilities allows execution of arbitrary code.

Solution
Apply patches.
Further details available in Customer Area

Provided and/or discovered by
1) Carsten Eiram, Secunia Research.
2, 3, 4) Sean Larsson, VeriSign iDefense Labs.
5) SkD, reported via ZDI.
6) Cody Pierce, TippingPoint DVLabs.

Changelog
Further details available in Customer Area

Original Advisory
Secunia Research:
http://secunia.com/secunia_research/2009-28/

MS10-004 (KB975416, KB973143, KB976881):
http://www.microsoft.com/technet/security/Bulletin/MS10-004.mspx

TippingPoint DVLabs:
http://dvlabs.tippingpoint.com/advisory/TPTI-10-02

iDefense Labs:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=840
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=841
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=842

Deep Links
Links available in Customer Area


Discuss this advisory
A new thread in our forum is automatically created for each posted Secunia Advisory. Activate the thread by commenting/discussing below.
Subject: Microsoft Office PowerPoint Multiple Vulnerabilities
 
No posts yet

-

You must be logged in to post a comment.



footer
© 2002-2010 Secunia ApS • Weidekampsgade 14A, Copenhagen, Denmark • +45 7020 5144 • info@secunia.com
Terms & Conditions and CopyrightReport vulnerability
CVE logo OTA logo First logo