This application requires Javascript for optimal performance.

MS.Excel.SXVI.iCache.Memory.Corruption

Release Date

Aug 12, 2010

Severity

high

Impact

The vulnerability may allow remote code execution if a user opens a specially crafted Excel file. An attacker who successfully exploits this vulnerability may gain the same user rights as the logged-on user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Description

Microsoft Excel, which forms part of Microsoft Office, is a commercial spreadsheet application written and distributed by Microsoft for Microsoft Windows and Mac OS X. It features calculation, graphing tools, pivot tables, and a macro programming language called Visual Basic for Applications.

In August 2010, a remote code execution vulnerability exists in the way that Microsoft Office Excel handles specially crafted Excel files. Technically, Excel doesn't validate the the SXVI.iCache value during loading of BIFF 8 files. In normal case, 'cfdbdb' in BIFF array of SXVI.iCache should be lesser than 'cfdbTot' as it's mentioned in public XLS specification. If it contains that 'cfdbdb' is larger than 'cfdbTot' in SXDB record or both 'cfdbdb' and 'cfdbTot' are quals 0, it might attempt to exploit the current vulnerability.

Microsoft Office Excel 2002 SP3 and 2003 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac do not properly parse the Excel file format, which may cause a "Excel Memory Corruption Vulnerability" via a crafted Excel file

Affected Products

Microsoft Office Excel 2002 Service Pack 3
Microsoft Office Excel 2003 Service Pack 3
Microsoft Office 2004 for Mac
Microsoft Office 2008 for Mac
Open XML File Format Converter for Mac

Recommended Actions

You can patch the exploit with the update found at http://support.microsoft.com/kb/2269707

You can also reduce the risk of the exploit by performing the one of the following:
1) Avoid opening un-trusted Excel files
2) If you have security concerns, use the Microsoft Office Isolated Conversion Environment (MOICE) to open Excel files. Refer to http://support.microsoft.com/kb/935865 for more information about MOICE.

Note: #2 may occur may issues. Please refer to the "Issues that may occur when you use MOICE" section of KB935865

Coverage

IPS
VCM

Common Vulnerabilities and Exposures (CVE)

CVE-2010-2562

Reference/s

http://technet.microsoft.com/en-us/security/bulletin/MS10-057.mspx (MS-ID)

Reference: VID-24108