PT-2010-2061 · Microsoft · Office 2004+3

Published 2010-03-10 · Updated 2018-10-12 · CVE-2010-0264

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Office Excel versions prior to the fixed version

Description A remote code execution issue exists in the way Microsoft Office Excel handles specially crafted Excel files. This allows an attacker to potentially take complete control of an affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Microsoft Office Excel 2002 SP3, update to a version that includes the fix for this issue. For Office 2004 and 2008 for Mac, update to a version that includes the fix for this issue. For Open XML File Format Converter for Mac, update to a version that includes the fix for this issue. As a temporary workaround, consider avoiding the use of specially crafted Excel files until a patch is available.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2010-0264

Affected Products

Office Excel

Office 2004

Office 2008

Open Xml File Format Converter For Mac

References · 8

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-017 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0264 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2010-0264 · Security Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7888 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2010/MS10-017 · Note
• http://us-cert.gov/cas/techalerts/TA10-068A.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0264 · Note
• http://securitytracker.com/id?1023698 · Note