HTTP: Microsoft Office Excel HFPicture Record Buffer Overflow

This signature detects attempts to exploit a known buffer overflow vulnerability in Microsoft Office Excel products. It is due to improper parsing of an Excel file that includes a malformed HFPicture record. Remote attackers can exploit this by enticing target users to open a malicious Excel file, potentially causing arbitrary code to be injected and executed in the security context of the current user. In a successful attack, the behavior of the target is dependent on the intention of the malicious code. In an unsuccessful attck, the application can terminate as a result of invalid memory access.

Extended Description

Microsoft Excel is prone to a remote code-execution vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to open a specially crafted Excel ('.xls') file. Successful exploits can allow attackers to execute arbitrary code with the privileges of the user running the application.

Affected Products

Avaya messaging_application_server,Microsoft excel_2002

References

BugTraq: 40526 40520

CVE: CVE-2010-0822

URL: https://www.exploit-db.com/moaub-24-microsoft-excel-obj-record-stack-overflow/

Short Name

HTTP:STC:DL:XLS-HFPICT

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Microsoft Office Excel HFPicture Record Buffer Overflow

Extended Description

Affected Products

References

Found a potential security threat?