what you don't know can hurt you

Microsoft Office TIFF Image Converter Two Buffer Overflows

Microsoft Office TIFF Image Converter Two Buffer Overflows
Posted Dec 20, 2010
Authored by Carsten Eiram | Site secunia.com

Secunia Research has discovered two vulnerabilities in Microsoft Office, which can be exploited by malicious people to compromise a user's system. An input validation error in the TIFF Import/Export Graphic Filter when copying certain data can be exploited to cause a heap-based buffer overflow via a specially crafted TIFF image. Another input validation error in the TIFF Import/Export Graphic Filter when copying certain data after having encountered a specific error can be exploited to cause a heap-based buffer overflow via a specially crafted TIFF image. Successful exploitation of the vulnerabilities may allow execution of arbitrary code when processing a TIFF image in an application using the graphics filter (e.g. opening the image in Microsoft Photo Editor or importing it into an Office document).

tags | advisory, overflow, arbitrary, vulnerability
advisories | CVE-2010-3947
MD5 | c936a3c75f287646d175d3e6d8984e12

Microsoft Office TIFF Image Converter Two Buffer Overflows

Change Mirror Download
====================================================================== 

Secunia Research 14/12/2010

- Microsoft Office TIFF Image Converter Two Buffer Overflows -

======================================================================
Table of Contents

Affected Software....................................................1
Severity.............................................................2
Vendor's Description of Software.....................................3
Description of Vulnerability.........................................4
Solution.............................................................5
Time Table...........................................................6
Credits..............................................................7
References...........................................................8
About Secunia........................................................9
Verification........................................................10

======================================================================
1) Affected Software

* Microsoft Office XP SP3
* Microsoft Office Converter Pack
* Microsoft Works 9

NOTE: Other versions may also be affected.

======================================================================
2) Severity

Rating: Highly critical
Impact: System compromise
Where: Remote

======================================================================
3) Vendor's Description of Software

"Microsoft Office is a complete suite of productivity and database
software that will help you save time and stay organized".

Product Link:
http://office.microsoft.com/

======================================================================
4) Description of Vulnerability

Secunia Research has discovered two vulnerabilities in Microsoft
Office, which can be exploited by malicious people to compromise a
user's system.

1) An input validation error in the TIFF Import/Export Graphic Filter
when copying certain data can be exploited to cause a heap-based
buffer overflow via a specially crafted TIFF image.

2) Another input validation error in the TIFF Import/Export Graphic
Filter when copying certain data after having encountered a specific
error can be exploited to cause a heap-based buffer overflow via a
specially crafted TIFF image.

Successful exploitation of the vulnerabilities may allow execution of
arbitrary code when processing a TIFF image in an application using
the graphics filter (e.g. opening the image in Microsoft Photo Editor
or importing it into an Office document).

======================================================================
5) Solution

Apply patches provided by MS10-105.

======================================================================
6) Time Table

07/07/2010 - Vendor notified about vulnerability #1.
08/07/2010 - Vendor notified about vulnerability #2.
08/07/2010 - Vendor response.
15/08/2010 - Vendor provides status update.
11/01/2010 - Status update requested.
11/01/2010 - Vendor provides status update (tentatively targetting
May 2010).
30/04/2010 - Vendor provides status update (slipped from May 2010
release and now tentatively targetting August 2010).
23/07/2010 - Vendor provides status update (slipped from August 2010
release and now scheduled for November 2010).
04/11/2010 - Vendor provides status update (slipped from November 2010
release and now scheduled for December 2010).
08/11/2010 - Vendor informed that December is the final deadline.
14/12/200X - Public disclosure.

======================================================================
7) Credits

Discovered by Carsten Eiram, Secunia Research.

======================================================================
8) References

The Common Vulnerabilities and Exposures (CVE) project has assigned
CVE-2010-3947 for the vulnerabilities.

======================================================================
9) About Secunia

Secunia offers vulnerability management solutions to corporate
customers with verified and reliable vulnerability intelligence
relevant to their specific system configuration:

http://secunia.com/advisories/business_solutions/

Secunia also provides a publicly accessible and comprehensive advisory
database as a service to the security community and private
individuals, who are interested in or concerned about IT-security.

http://secunia.com/advisories/

Secunia believes that it is important to support the community and to
do active vulnerability research in order to aid improving the
security and reliability of software in general:

http://secunia.com/secunia_research/

Secunia regularly hires new skilled team members. Check the URL below
to see currently vacant positions:

http://secunia.com/corporate/jobs/

Secunia offers a FREE mailing list called Secunia Security Advisories:

http://secunia.com/advisories/mailing_lists/

======================================================================
10) Verification

Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2009-30/

Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/

======================================================================

Login or Register to add favorites

File Archive:

July 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    15 Files
  • 2
    Jul 2nd
    19 Files
  • 3
    Jul 3rd
    11 Files
  • 4
    Jul 4th
    0 Files
  • 5
    Jul 5th
    0 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    0 Files
  • 9
    Jul 9th
    0 Files
  • 10
    Jul 10th
    0 Files
  • 11
    Jul 11th
    0 Files
  • 12
    Jul 12th
    0 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    0 Files
  • 16
    Jul 16th
    0 Files
  • 17
    Jul 17th
    0 Files
  • 18
    Jul 18th
    0 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close