Signature Detail

HTTP: Microsoft Office PowerPoint Notes Container Heap Corruption

This signature detects attempts to exploit a known vulnerability in Microsoft Office PowerPoint. It is due to the way that PowerPoint handles HashCode10Atom records inside of NotesContainer records in malicious PowerPoint (PPT) documents. A successful attack can lead to memory corruption and arbitrary code execution.

Extended Description

Microsoft PowerPoint is prone to a remote code-execution vulnerability. An attacker could exploit this issue by enticing a victim to open a malicious PowerPoint file. Successfully exploiting this issue would allow the attacker to execute arbitrary code in the context of the currently logged-in user.

Affected Products

• Microsoft Office 2004 for Mac
• Microsoft PowerPoint 2002 SP1
• Microsoft PowerPoint 2002 SP2
• Microsoft PowerPoint 2002 SP3
• Microsoft PowerPoint 2002
• Microsoft PowerPoint 2003 SP1
• Microsoft PowerPoint 2003 SP2
• Microsoft PowerPoint 2003 SP3
• Microsoft PowerPoint 2003
• Microsoft PowerPoint 2004 for Mac

References

• BugTraq: 34840
• CVE: CVE-2009-1130