Technical Description

A vulnerability has been identified in Microsoft Office, which could be exploited by attackers to compromise a vulnerable system. This issue is caused by a buffer overflow error in "MSO.DLL" when processing malformed Office data, which could be exploited by attackers to execute arbitrary code by tricking a user into opening a specially crafted Office document.

Affected Products

Microsoft Office XP Service Pack 3
Microsoft Office 2004 for Mac

Solution

Apply patch for Microsoft Office XP Service Pack 3:
http://www.microsoft.com/downloads/details.aspx?familyid=47553f45-fa10-40e5-8267-9d42ff560a62

Apply patch for Microsoft Office 2004 for Mac:
http://www.microsoft.com/downloads/details.aspx?FamilyID=7c985595-00c5-44b8-81c3-59d9967220f8

References

http://www.vupen.com/english/advisories/2010/0336
http://www.microsoft.com/technet/security/bulletin/ms10-003.mspx

Credits

Vulnerability reported by Damian Frizza (Core Security Technologies).

ChangeLog

2010-02-09 : Initial release

Vulnerability Management

Subscribe to VUPEN VNS and receive real-time alerts with CVE, CWE, and CVSS when new advisories or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.