Signature Detail

HTTP: Microsoft Office RTF File Parsing Remote Code Execution

This signature detects attempts to exploit a known vulnerability against Microsoft Office. A successful attack can lead to arbitrary code execution.

Extended Description

Microsoft Office is prone to a remote stack-based buffer-overflow vulnerability because the software fails to perform adequate boundary checks on user-supplied data. An attacker can exploit this issue by enticing a victim to open a malicious RTF file or view an email in RTF format. Successfully exploiting this issue would allow the attacker to corrupt memory and execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will result in a denial-of-service condition.

Affected Products

• Microsoft office_2003 SP1
• Microsoft office_2003 SP2
• Microsoft office_2003
• Microsoft office_2004_for_mac
• Microsoft office_2007 SP1
• Microsoft office_2007 SP2
• Microsoft office_2007
• Microsoft office_2008_for_mac
• Microsoft office_2010
• Microsoft office_2010_(32-bit_edition)
• Microsoft office_2010_(64-bit_edition)
• Microsoft office_2011_for_mac
• Microsoft office_xp SP1
• Microsoft office_xp SP2
• Microsoft office_xp SP3
• Microsoft office_xp
• Microsoft open_xml_file_format_converter_for_mac

References

• BugTraq: 44652
• CVE: CVE-2010-3333
• URL: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=880