PT-2009-2896 · Microsoft · Office Powerpoint
Sean Larsson
·
Publicado
2009-05-12
·
Atualizado
2018-10-12
·
CVE-2009-0221
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Microsoft Office PowerPoint versions 2002 SP3 through 2003 SP3
Description
The issue is related to an integer overflow that allows remote attackers to execute arbitrary code via a crafted PowerPoint file. This file can contain a record type for collaboration information for different slides with a field specifying a large number of records, triggering an under-allocated buffer and a heap-based buffer overflow. A remote code execution vulnerability exists in the way Microsoft Office PowerPoint handles specially crafted PowerPoint files, which could be exploited by an attacker creating such a file to be included as an email attachment or hosted on a specially crafted or compromised website.
Recommendations
For Microsoft Office PowerPoint versions 2002 SP3 and 2003 SP3, update to a version that includes a fix for the integer overflow issue to prevent exploitation.
As a temporary workaround, consider avoiding the use of collaboration information for different slides in PowerPoint files until a patch is available.
Correção
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Office Powerpoint