PT-2011-2087 · Microsoft · Excel Viewer+4

Publicado 2011-04-13 · Atualizado 2018-10-12 · CVE-2011-0098

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Excel versions 2002 SP3, 2003 SP3, 2007 SP2, and 2010 Office 2004 and 2008 for Mac Open XML File Format Converter for Mac Excel Viewer SP2 Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2

Description A remote code execution issue exists in the way Microsoft Excel handles specially crafted Excel files, potentially allowing an attacker to execute arbitrary code via an XLS file with a large record size. This could enable an attacker to take complete control of an affected system, install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Microsoft Excel 2002 SP3, 2003 SP3, 2007 SP2, and 2010, update to a version that is not affected by this issue. For Office 2004 and 2008 for Mac, update to a version that is not affected by this issue. For Open XML File Format Converter for Mac, update to a version that is not affected by this issue. For Excel Viewer SP2, update to a version that is not affected by this issue. For Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2, update to a version that is not affected by this issue. As a temporary workaround, consider avoiding the use of XLS files from untrusted sources until a patch is available.

Correção

RCE

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CVE-2011-0098

Produtos afetados

Excel Viewer

Office Excel

Office

Office Compatibility Pack

Open Xml File Format Converter For Mac

Referências · 13

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-021 · Aviso do Fabricante
• http://securityfocus.com/bid/47235 · Nota
• http://vupen.com/english/advisories/2011/0940 · Aviso do Fabricante
• http://osvdb.org/71759 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0098 · Nota
• http://secunia.com/advisories/39122 · Aviso do Fabricante
• http://securitytracker.com/id?1025337 · Nota
• http://us-cert.gov/cas/techalerts/TA11-102A.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-0098 · Nota de Segurança
• http://secunia.com/secunia_research/2011-32 · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12034 · Nota
• https://docs.microsoft.com/security-updates/securitybulletins/2011/MS11-021 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0098 · Nota de Segurança