Signature Detail

HTTP: Microsoft PowerPoint OEPlaceholderAtom placementId Invalid Array Indexing

This signature detects attempts to exploit a known code execution vulnerability in Microsoft Office PowerPoint. It is due to the way that the application handles specially crafted PowerPoint files. A remote unauthenticated attacker can entice a user to open a maliciously crafted file, which can result in arbitrary code execution.

Extended Description

Microsoft PowerPoint is prone to a remote code-execution vulnerability. An attacker can exploit this issue by enticing an unsuspecting user to open a malicious PowerPoint file. Successful exploits would allow the attacker to execute arbitrary code in the context of the currently logged-in user.

Affected Products

• Microsoft Office 2004 for Mac
• Microsoft PowerPoint 2002 SP1
• Microsoft PowerPoint 2002 SP2
• Microsoft PowerPoint 2002 SP3
• Microsoft PowerPoint 2002
• Microsoft PowerPoint 2003 SP1
• Microsoft PowerPoint 2003 SP2
• Microsoft PowerPoint 2003 SP3
• Microsoft PowerPoint 2003

References

• BugTraq: 38103
• CVE: CVE-2010-0031
• URL: http://www.microsoft.com/technet/security/bulletin/MS10-004.mspx