Multiple vulnerabilities have been identified in Microsoft Office Excel, which could be exploited by attackers to compromise a vulnerable system.

The first issue is caused by a memory corruption error when processing malformed records, which could be exploited by attackers to execute arbitrary code by tricking a user into opening a specially crafted Excel document.

The second vulnerability is caused by a memory corruption error when processing malformed "BRAI" BIFF records, which could be exploited by attackers to execute arbitrary code by tricking a user into opening a specially crafted Excel document.

The third issue is caused by a memory corruption error when processing malformed data related to "MDXTuple" and "ContinueFRT12" records, which could be exploited by attackers to execute arbitrary code by tricking a user into opening a specially crafted Excel document.

The fourth vulnerability is caused by a memory corruption error when processing malformed data related to "MDXSet" and "ContinueFRT12" records, which could be exploited by attackers to execute arbitrary code by tricking a user into opening a specially crafted Excel document.

The fifth issue is caused by a memory corruption error when processing malformed data related to "FnGroupName", "BuiltInFnGroupCount" and "FnGrp12" records, which could be exploited by attackers to execute arbitrary code by tricking a user into opening a specially crafted Excel document.

The sixth vulnerability is caused due to an uninitialized pointer when processing malformed data, which could be exploited by attackers to execute arbitrary code by tricking a user into opening a specially crafted Excel document.

The seventh issue is caused by a memory corruption error when processing malformed "DbOrParamQry" records, which could be exploited by attackers to execute arbitrary code by tricking a user into opening a specially crafted Excel document.

Affected Products

Microsoft Excel 2002 Service Pack 3
Microsoft Excel 2003 Service Pack 3
Microsoft Excel 2007 Service Pack 1
Microsoft Excel 2007 Service Pack 2
Microsoft Excel Viewer Service Pack 1
Microsoft Excel Viewer Service Pack 2

Microsoft Office XP Service Pack 3
Microsoft Office 2003 Service Pack 3
2007 Microsoft Office System Service Pack 1
2007 Microsoft Office System Service Pack 2
Microsoft Office for Mac
Microsoft Office 2004 for Mac
Microsoft Office 2008 for Mac
Open XML File Format Converter for Mac
Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Service Pack 1
Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Service Pack 2
Microsoft Office SharePoint Server 2007 Service Pack 1
Microsoft Office SharePoint Server 2007 Service Pack 2

Solution

Apply patches :
http://www.microsoft.com/technet/security/bulletin/ms10-017.mspx

References

http://www.vupen.com/english/advisories/2010/0566
http://www.microsoft.com/technet/security/bulletin/ms10-017.mspx
http://www.zerodayinitiative.com/advisories/ZDI-10-025
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=862
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=861
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=860
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=859

In-depth Binary Analysis

Available in customer area as part of VUPEN Binary Analysis & Exploits Service and VUPEN Vulnerability Notification Service Ultimate Feed Edition.
 

Private Exploit or PoC

Available in customer area as part of VUPEN Binary Analysis & Exploits Service and VUPEN Vulnerability Notification Service Ultimate Feed Edition.
 

Credits

Vulnerabilities reported by Nicolas Joly (VUPEN Security), Sean Larsson (VeriSign iDefense Labs), ZDI, and Damián Frizza (Core Security Technologies).

Changelog

2010-03-09 : Initial release

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.