PT-2010-4673 · Microsoft · Office 2004 For Mac+1

Published 2010-10-13 · Updated 2018-10-12 · CVE-2010-3237

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Excel versions 2002 SP3 Office 2004 for Mac

Description A remote code execution issue exists in the way Microsoft Excel handles specially crafted Excel files. This allows remote attackers to execute arbitrary code via a crafted Excel document. An attacker who successfully exploits this issue could take complete control of an affected system, then install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Microsoft Excel 2002 SP3, update to a version that properly validates record information to prevent arbitrary code execution. For Office 2004 for Mac, update to a version that correctly handles specially crafted Excel files to mitigate the risk of remote code execution.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2010-3237

Affected Products

Office Excel

Office 2004 For Mac

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2010-3237 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-080 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3237 · Security Note
• http://us-cert.gov/cas/techalerts/TA10-285A.html · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2010/MS10-080 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3237 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6727 · Note