(MS10-103) Vulnerabilities in Microsoft Publisher Could Allow Remote Code Execution (2292970)
Severity: HIGH
CVE Identifier: CVE-2010-2569,CVE-2010-2570,CVE-2010-2571,CVE-2010-3954,CVE-2010-3955
Advisory Date: FEB 10, 2011
DESCRIPTION
This update resolves vulnerabilities in Microsoft Publisher that could allow remote code execution. An attacker can exploit the vulnerability by opening a specially crafted Publisher file. An attacker could take complete control over an affected system and install programs; view, change, or delete data; or create new user accounts will full user rights. More specifically, this update addresses the vulnerabilities by correcting the way that Microsoft Publisher parses specially crafted Publisher files.
TREND MICRO PROTECTION INFORMATION
For information on patches specific to the affected software, please proceed to the Microsoft Web page.
Trend Micro clients using OfficeScan with Intrusion Defense Firewall (IDF) may refer to the table below for the pattern filter identifier(s):
| Vulnerability ID | Identifier & Title | IDF First Pattern Version | IDF First Pattern Release Version |
|---|---|---|---|
| CVE-2010-2569 | 1004544 - Size Value Heap Corruption in pubconv.dll Vulnerability | 10-038 | Dec 15, 2010 |
| CVE-2010-3955 | 1004545 - Array Indexing Memory Corruption Vulnerability | 10-038 | Dec 15, 2010 |
SOLUTION
AFFECTED SOFTWARE AND VERSION
- Microsoft Office XP Service Pack 3
- Microsoft Office 2003 Service Pack 3
- Microsoft Office 2007 Service Pack 2
- Microsoft Office 2010 (32-bit editions)
- Microsoft Office 2010 (64-bit editions)