Core Security Technologies has discovered a vulnerability in Microsoft Office Excel, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a logic error when parsing certain records following a SXDB (PivotTable Cache Data) record having the "cfdbTot" field value set to zero. This can be exploited to cause a stack-based buffer overflow via a specially crafted Excel file.

Successful exploitation allows execution of arbitrary code.

Solution
Apply patches.
Further details available in Customer Area

Provided and/or discovered by
Damian Frizza, Core Security Technologies.

Changelog
Further details available in Customer Area

Original Advisory
MS10-057 (KB2269707, KB2284162, KB2284171, KB2284179, KB2264397, KB2264403):
http://www.microsoft.com/technet/security/bulletin/MS10-057.mspx

Core Security Technologies:
http://www.coresecurity.com/content/CORE-2010-0407-Excel-PivotTable-CDR-overflow

Technical Analysis
Further details available in Customer Area

Deep Links
Links available in Customer Area