PT-2010-4117 · Microsoft · Office Publisher

Published 2010-12-16 · Updated 2018-10-12 · CVE-2010-2571

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Publisher versions 2002 SP3 through 2003 SP3

Description A remote code execution issue exists in the way Microsoft Publisher opens Publisher files. This could be exploited by an attacker creating a specially crafted Publisher file, which could be sent as an email attachment or hosted on a compromised website, and then convincing a user to open the file. If the user has administrative rights, the attacker could gain complete control of the system, allowing them to install programs, view, change, or delete data, or create new accounts with full user rights. Users with fewer user rights may be less affected.

Recommendations For Microsoft Publisher 2002 SP3, update to a version that is not affected by this issue. For Microsoft Publisher 2003 SP3, update to a version that is not affected by this issue. As a temporary workaround, consider restricting the use of the pubconv.dll until a patch is available. Avoid opening specially crafted Publisher files from untrusted sources.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2010-2571

Affected Products

Office Publisher

References · 8

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2571 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-103 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-2571 · Security Note
• http://us-cert.gov/cas/techalerts/TA10-348A.html · Note
• http://securitytracker.com/id?1024885 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2571 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12298 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2010/MS10-103 · Note