CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
EPSS
Percentile
99.7%
Added: 08/19/2010
CVE: CVE-2010-2562
BID: 42199
OSVDB: 66991
Microsoft Excel, part of the Microsoft Office product suite, is a spreadsheet application for Windows and Macintosh platforms.
Microsoft Excel is vulnerable to a stack buffer overflow due to a logic error when parsing certain records following a SXDB
(PivotTable Cache Data) record having the cfdbTot
field value set to zero. This vulnerability can be exploited by enticing a user to open a specially crafted Excel file.
Apply the patch referenced in Microsoft Security Bulletin 10-057.
<http://www.microsoft.com/technet/security/bulletin/MS10-057.mspx>
Exploit works on Microsoft Office Excel 2002 SP3 and requires the user to open the exploit file in Microsoft Excel.
This exploit requires the Compress-Zlib PERL module. This module is available from cpan.org.
It may take some time for the exploit to compress the XLS file before handling HTTP requests.
It may take some time to establish the shell session as the XLS file needs to be decompressed.
Windows