Signature Detail

HTTP: Microsoft Office Art Property Table Buffer Overflow

This signature detects attempts to exploit a known vulnerability against Microsoft Office document parser. A successful attack can lead to arbitrary code execution.

Extended Description

Microsoft GDI+ is prone to a remote code-execution vulnerability because the vector graphics link library improperly processes Microsoft Office objects. An attacker could exploit this issue to execute arbitrary code with the privileges of the currently logged-in user. Failed exploit attempts may crash applications that use the library.

Affected Products

• Microsoft office_xp SP1
• Microsoft office_xp SP2
• Microsoft office_xp SP3
• Microsoft office_xp
• Nortel_networks callpilot 1002Rp
• Nortel_networks callpilot 200I
• Nortel_networks callpilot 201I
• Nortel_networks callpilot 702T
• Nortel_networks callpilot 703T
• Nortel_networks contact_center_administration_ccma 6.0
• Nortel_networks contact_center_administration_ccma 7.0
• Nortel_networks contact_center_express
• Nortel_networks contact_center_ncc
• Nortel_networks contact_center-tapi_server
• Nortel_networks media_processing_svr_1000_rel 3.0
• Nortel_networks media_processing_svr_500_rel 3.0
• Nortel_networks multimedia_comm_mas
• Nortel_networks self-service-ccss7
• Nortel_networks self-service_ccxml
• Nortel_networks self-service_media_processing_server
• Nortel_networks self-service_mps_100
• Nortel_networks self-service_mps_1000
• Nortel_networks self-service_mps_500
• Nortel_networks self-service_peri_application
• Nortel_networks self-service_peri_workstation
• Nortel_networks self-service_speech_server
• Nortel_networks self_service_voicexml
• Nortel_networks self-service_wvads
• Nortel_networks symposium_agent

References

• BugTraq: 36650
• CVE: CVE-2009-2528