PT-2011-4438 · Microsoft · Office Publisher

Will Dormann · Published 2011-12-13 · Updated 2018-10-12 · CVE-2011-3411

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Publisher version 2003 SP3

Description A remote code execution issue exists due to the incorrect handling of values in memory when parsing Publisher files. This could allow an attacker to execute arbitrary code by creating a specially crafted Publisher file. The attacker could convince the user to open this file, potentially via an email attachment or a compromised website. If the user has administrative rights, the attacker could gain complete control of the system, allowing them to install programs, view, change, or delete data, or create new accounts with full user rights. Users with fewer user rights may be less affected.

Recommendations For Microsoft Publisher 2003 SP3, consider avoiding the use of potentially malicious Publisher files until a fix is available. As a temporary workaround, restrict the use of Microsoft Publisher for opening files from untrusted sources.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2011-3411

Affected Products

Office Publisher

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2011-3411 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3411 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-091 · Vendor Advisory
• http://us-cert.gov/cas/techalerts/TA11-347A.html · Note
• http://technet.microsoft.com/en-us/security/bulletin/MS11-091 · Note
• http://kb.cert.org/vuls/id/361441 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14346 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3411 · Note
• http://securitytracker.com/id?1026414 · Note