Microsoft Office Excel PivotTable Cache Data Record Handling Overflow

Added: 08/19/2010
CVE: CVE-2010-2562
BID: 42199
OSVDB: 66991

Background

Microsoft Excel, part of the Microsoft Office product suite, is a spreadsheet application for Windows and Macintosh platforms.

Problem

Microsoft Excel is vulnerable to a stack buffer overflow due to a logic error when parsing certain records following a SXDB (PivotTable Cache Data) record having the cfdbTot field value set to zero. This vulnerability can be exploited by enticing a user to open a specially crafted Excel file.

Resolution

Apply the patch referenced in Microsoft Security Bulletin 10-057.

References

<http://www.microsoft.com/technet/security/bulletin/MS10-057.mspx&gt;

Limitations

Exploit works on Microsoft Office Excel 2002 SP3 and requires the user to open the exploit file in Microsoft Excel.

This exploit requires the Compress-Zlib PERL module. This module is available from cpan.org.

It may take some time for the exploit to compress the XLS file before handling HTTP requests.

It may take some time to establish the shell session as the XLS file needs to be decompressed.

Platforms

Windows