HTTP: Microsoft PowerPoint OEPlaceholderAtom placementId Invalid Array Indexing

This signature detects attempts to exploit a known code execution vulnerability in Microsoft Office PowerPoint. It is due to the way that the application handles specially crafted PowerPoint files. A remote unauthenticated attacker can entice a user to open a maliciously crafted file, which can result in arbitrary code execution.

Extended Description

Microsoft PowerPoint is prone to a remote code-execution vulnerability. An attacker can exploit this issue by enticing an unsuspecting user to open a malicious PowerPoint file. Successful exploits would allow the attacker to execute arbitrary code in the context of the currently logged-in user.

Affected Products

Microsoft powerpoint_2003

References

BugTraq: 38103 20322

CVE: CVE-2006-3876

URL: http://www.microsoft.com/technet/security/bulletin/MS10-004.mspx http://www.fortinet.com/fortiguardcenter/advisory/fg-2006-27.html

Short Name

HTTP:STC:DL:PPT-OEP-ATOM-INV

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Microsoft PowerPoint OEPlaceholderAtom placementId Invalid Array Indexing

Extended Description

Affected Products

References

Found a potential security threat?