HTTP: Microsoft Office Malformed String Parsing Code Execution

This signature detects attempts to exploit a known vulnerability against Microsoft Office. A successful attack can lead to arbitrary code execution.

Extended Description

Microsoft Office is prone to a code-execution vulnerability. This condition can occur when a malformed string within an Office file is parsed. This vulnerability is located in a shared library used by multiple Office applications, potentially allowing many different attack vectors. An attacker could exploit this issue by enticing a victim to load a malicious Office file. If the vulnerability is successfully exploited, this could result in the execution of arbitrary code in the context of the currently logged-in user. This issue differs from the one described in BID 18912 (Microsoft Office String Parsing Remote Code Execution Vulnerability).

Affected Products

Microsoft office_xp

References

BugTraq: 28170 17252 18889 40531

CVE: CVE-2010-1249

URL: http://www.zerodayinitiative.com/advisories/zdi-10-103/

Short Name

HTTP:STC:DL:MS-OFFICE-STRING

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Microsoft Office Malformed String Parsing Code Execution

Extended Description

Affected Products

References

Found a potential security threat?