Signature Detail

HTTP: Microsoft Office PowerPoint Legacy Format Printer Record Buffer Overflow

This signature detects attempts to exploit a known vulnerability in Microsoft Office PowerPoint. It is due to insufficient boundary check when processing crafted Printer records. A successful attack can lead to memory corruption and arbitrary code execution.

Extended Description

Microsoft PowerPoint is prone to a remote code-execution vulnerability. An attacker can exploit this issue by enticing a victim to open a specially crafted PowerPoint 4.0 file. Successfully exploiting this issue can allow the attacker to execute arbitrary code in the context of the currently logged-in user.

Affected Products

• Microsoft powerpoint_2000 SP2
• Microsoft powerpoint_2000 SP3
• Microsoft powerpoint_2000 SR1
• Microsoft powerpoint_2000
• Microsoft powerpoint_2002 SP1
• Microsoft powerpoint_2002 SP2
• Microsoft powerpoint_2002 SP3
• Microsoft powerpoint_2002
• Microsoft powerpoint_2003 SP1
• Microsoft powerpoint_2003 SP2
• Microsoft powerpoint_2003 SP3
• Microsoft powerpoint_2003

References

• BugTraq: 34882
• CVE: CVE-2009-0227