|
|
| |
Credit:
The information has been provided by Aniway.
The original article can be found at: http://www.zerodayinitiative.com/advisories/ZDI-11-120/
|
| |
Vulnerable Systems:
* Microsoft Office Excel 2002
User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The flaw exists within the methods used for RealTimeData Record Parsing. When handling a stTopic field has a bit set specifying double byte characters in the following field the value of a global pointer is improperly calculated. This pointer is later used in a memcpy operation whose source is user supplied data. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the user.
Patch Availability:
Microsoft has issued an update to correct this vulnerability. More details can be found at:
http://www.microsoft.com/technet/security/bulletin/ms11-021.mspx
CVE Information:
CVE-2011-0101
Disclosure Timeline:
2010-11-15 - Vulnerability reported to vendor
2011-04-12 - Coordinated public release of advisory
|
|
|
