PT-2010-1178 · Microsoft · Open Xml File Format Converter For Mac+1

Snake · Published 2010-11-09 · Updated 2025-04-07 · CVE-2010-3333

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Office versions XP SP3 through 2010 Microsoft Office for Mac versions 2004 through 2011 Open XML File Format Converter for Mac version (affected versions not specified)

Description A remote code execution issue exists due to a stack-based buffer overflow when parsing specially crafted Rich Text Format (RTF) data. This could allow an attacker to execute arbitrary code and potentially take complete control of an affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights. The impact may be less severe for users with limited user rights compared to those operating with administrative rights.

Recommendations For Microsoft Office versions XP SP3 through 2010, update to a version that is not affected by this issue. For Microsoft Office for Mac versions 2004 through 2011, update to a version that is not affected by this issue. For Open XML File Format Converter for Mac, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-119

Related Identifiers

BDU:2022-04045

CVE-2010-3333

Affected Products

Office

Open Xml File Format Converter For Mac

References · 30

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/ms10_087_rtf_pfragments_bof.rb · Exploit
• 🔥 https://exploit-db.com/exploits/24526 · Exploit
• 🔥 https://exploit-db.com/exploits/16686 · Exploit
• 🔥 https://exploit-db.com/exploits/18334 · Exploit
• 🔥 https://exploit-db.com/exploits/17474 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-3333 · Security Note
• https://bdu.fstec.ru/vul/2022-04045 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3333 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-087 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/cve-2010-3333 · Security Note
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note
• https://t.me/cvenotify/110613 · Telegram Post
• http://secunia.com/advisories/38521 · Note
• http://securityfocus.com/bid/44652 · Note
• https://t.me/aptreports/9334 · Telegram Post