Microsoft Excel DBQueryExt record parsing vulnerability

2010-07-08T00:00:00
ID SAINT:4D8456C1A241C12D2BAEC20EA5D3EE80
Type saint
Reporter SAINT Corporation
Modified 2010-07-08T00:00:00

Description

Added: 07/08/2010
CVE: CVE-2010-1253
BID: 40531
OSVDB: 65228

Background

Microsoft Excel, part of the Microsoft Office product suite, is a spreadsheet application for Windows and Macintosh platforms.

Problem

A vulnerability in Microsoft Excel allows command execution when a user opens a spreadsheet file containing a specially crafted DBQueryExt record.

Resolution

Apply the update referenced in Microsoft Security Bulletin 10-038.

References

<http://www.zerodayinitiative.com/advisories/ZDI-10-103/>

Limitations

Exploit works on Microsoft Excel 2002 SP3 and requires a user to open the exploit file in Microsoft Excel.

There may be a delay before the exploit succeeds.

Platforms

Windows