HTTP: Microsoft Office RTF File Parsing Remote Code Execution

This signature detects attempts to exploit a known vulnerability against Microsoft Office. A successful attack can lead to arbitrary code execution.

Extended Description

Microsoft Office is prone to a remote stack-based buffer-overflow vulnerability because the software fails to perform adequate boundary checks on user-supplied data. An attacker can exploit this issue by enticing a victim to open a malicious RTF file or view an email in RTF format. Successfully exploiting this issue would allow the attacker to corrupt memory and execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will result in a denial-of-service condition.

Affected Products

Microsoft office_2007

References

BugTraq: 44652

CVE: CVE-2010-3333

URL: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=880

Short Name

HTTP:STC:DL:RTF-FPARSE-RCE

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Microsoft Office RTF File Parsing Remote Code Execution

Extended Description

Affected Products

References

Found a potential security threat?