PT-2011-3005 · Microsoft · Open Xml File Format Converter For Mac+3

Published 2011-05-13 · Updated 2018-10-12 · CVE-2011-1269

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft PowerPoint versions 2002 SP3, 2003 SP3, 2007 SP2 Office versions 2004, 2008 for Mac Open XML File Format Converter for Mac Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats version SP2

Description A remote code execution issue exists due to improper handling of memory during file parsing, allowing attackers to execute arbitrary code via a crafted PowerPoint document. This could enable an attacker to take complete control of an affected system, install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Microsoft PowerPoint versions 2002 SP3, 2003 SP3, 2007 SP2, update to a version that properly handles memory during file parsing to prevent remote code execution. For Office versions 2004, 2008 for Mac, update to a version that properly handles memory during file parsing to prevent remote code execution. For Open XML File Format Converter for Mac, update to a version that properly handles memory during file parsing to prevent remote code execution. For Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats version SP2, update to a version that properly handles memory during file parsing to prevent remote code execution.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2011-1269

Affected Products

Office Powerpoint

Office

Office Compatibility Pack For Word

Open Xml File Format Converter For Mac

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2011-1269 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1269 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-036 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1269 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12438 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2011/MS11-036 · Note