PT-2010-4110 · Microsoft · Office+2

Damián Frizza · Published 2010-08-11 · Updated 2018-10-12 · CVE-2010-2562

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Office Excel versions 2002 SP3 through 2003 SP3 Office versions 2004 through 2008 for Mac Open XML File Format Converter for Mac (affected versions not specified)

Description The issue arises from improper parsing of the Excel file format, allowing remote attackers to execute arbitrary code or cause a denial of service due to memory corruption via a crafted Excel file. This vulnerability enables an attacker to take complete control of an affected system, potentially leading to the installation of programs, viewing, changing, or deleting data, or creating new accounts with full user rights.

Recommendations For Microsoft Office Excel versions 2002 SP3 through 2003 SP3, update to a version that properly handles Excel file formats to prevent memory corruption. For Office versions 2004 through 2008 for Mac, apply the necessary patches or updates to ensure the secure handling of Excel files. For Open XML File Format Converter for Mac, consider disabling the conversion of Excel files until a patch or update is available to address the memory corruption issue.

Fix

DoS

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2010-2562

Affected Products

Office Excel

Office

Open Xml File Format Converter For Mac

References · 7

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2562 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2010-2562 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-057 · Vendor Advisory
• https://docs.microsoft.com/security-updates/securitybulletins/2010/MS10-057 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2562 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12088 · Note
• http://us-cert.gov/cas/techalerts/TA10-222A.html · Note