(MS10-103) Vulnerabilities in Microsoft Publisher Could Allow Remote Code Execution (2292970)

Publish date: February 10, 2011
  Severity: HIGH
  CVE Identifier: CVE-2010-2569,CVE-2010-2570,CVE-2010-2571,CVE-2010-3954,CVE-2010-3955
  Advisory Date: FEB 10, 2011

  DESCRIPTION

This update resolves vulnerabilities in Microsoft Publisher that could allow remote code execution. An attacker can exploit the vulnerability by opening a specially crafted Publisher file. An attacker could take complete control over an affected system and install programs; view, change, or delete data; or create new user accounts will full user rights. More specifically, this update addresses the vulnerabilities by correcting the way that Microsoft Publisher parses specially crafted Publisher files.

  TREND MICRO PROTECTION INFORMATION

For information on patches specific to the affected software, please proceed to the Microsoft Web page.

Trend Micro clients using OfficeScan with Intrusion Defense Firewall (IDF) may refer to the table below for the pattern filter identifier(s):

Vulnerability ID Identifier & Title IDF First Pattern Version IDF First Pattern Release Version
CVE-2010-2569 1004544 - Size Value Heap Corruption in pubconv.dll Vulnerability 10-038 Dec 15, 2010
CVE-2010-3955 1004545 - Array Indexing Memory Corruption Vulnerability 10-038 Dec 15, 2010

  SOLUTION

  AFFECTED SOFTWARE AND VERSION

  • Microsoft Office XP Service Pack 3
  • Microsoft Office 2003 Service Pack 3
  • Microsoft Office 2007 Service Pack 2
  • Microsoft Office 2010 (32-bit editions)
  • Microsoft Office 2010 (64-bit editions)

Featured Stories