Signature Detail

HTTP: Microsoft Office Excel SxView Record Parsing Memory Corruption

This signature detects attempts to exploit a known vulnerability in Microsoft Office Excel. It is due to the way Microsoft Office Excel handles specially crafted Excel files that include a malformed SxView record, allowing for memory corruption. Remote attackers can exploit this by enticing target users to open a malicious Excel file, potentially causing arbitrary code to be injected and executed in the security context of the current logged on user.

Extended Description

Microsoft Excel is prone to a remote code-execution vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to open a specially crafted Excel ('.xls') file. Successful exploits can allow attackers to execute arbitrary code with the privileges of the user running the application.

Affected Products

• Avaya Meeting Exchange - Client Registration Server
• Avaya Meeting Exchange - Recording Server
• Avaya Meeting Exchange - Streaming Server
• Avaya Meeting Exchange - Web Conferencing Server
• Avaya Meeting Exchange - Webportal
• Avaya Messaging Application Server 4
• Avaya Messaging Application Server 5
• Avaya Messaging Application Server MM 1.1
• Avaya Messaging Application Server MM 2.0
• Avaya Messaging Application Server MM 3.0
• Avaya Messaging Application Server MM 3.1
• Avaya Messaging Application Server
• Microsoft Excel 2002 SP1
• Microsoft Excel 2002 SP2
• Microsoft Excel 2002 SP3
• Microsoft Excel 2002
• Microsoft Excel 2003 SP1
• Microsoft Excel 2003 SP2
• Microsoft Excel 2003 SP3
• Microsoft Excel 2003
• Microsoft Excel 2007 SP1
• Microsoft Excel 2007 SP2
• Microsoft Excel 2007
• Microsoft Excel Viewer SP1
• Microsoft Excel Viewer SP2
• Microsoft Excel Viewer
• Microsoft Office 2004 for Mac
• Microsoft Office 2008 for Mac
• Microsoft Office Compatibility Pack 2007 SP1
• Microsoft Office Compatibility Pack 2007 SP2
• Microsoft Office Compatibility Pack 2007
• Microsoft Open XML File Format Converter for Mac

References

• BugTraq: 40518
• CVE: CVE-2010-0821