Check Point Advisories

Microsoft Office Excel Label Record Buffer Overflow

Vulnerability
Protection

Check Point Reference:	CPAI-2012-032
Date Published:	24 Jan 2012
Severity:	High
Last Updated:	Wednesday 24 April, 2024
Source:	CVE-2011-0098
Protection Provided by:	Security Gateway R75
Who is Vulnerable?	Microsoft Excel 2002 Microsoft Excel 2003 Microsoft Excel 2004 for Mac Microsoft Excel 2007 Microsoft Excel 2008 for Mac Microsoft Excel 2010
Vulnerability Description	A code execution vulnerability has been reported in Microsoft Office Excel.
Vulnerability Details	The vulnerability is due to a flaw in the parsing of Label record in Excel documents, causing a buffer overflow. Remote attackers can exploit this vulnerability by enticing target users to open a malicious Excel file. In an attack scenario, where arbitrary code is injected and executed on the target machine, the behaviour of the target is dependent on the intention of the malicious code. If such an attack is not executed successfully, the vulnerable application may terminate abnormally.

Protection Overview

This protection will detect and block the transferring of malformed Excel files over HTTP.

In order for the protection to be activated, update your product to the latest update. For information on how to update , go to SBP-2006-05, Protection tab and select the version of your choice.

Security Gateway R75 / R71 / R70

In the IPS tab, click Protections and find the Microsoft Office Excel Label Record Buffer Overflow (MS11-021) protection using the Search tool and Edit the protection's settings.
Install policy on all modules.

SmartView Tracker will log the following entries:
Attack Name: Content Protection Violation
Attack Information: Microsoft Office Excel label record buffer overflow (MS11-021)