CVE-2012-0143

Vulnerability

Microsoft Excel 2003 SP3 and Office 2008 for Mac improperly handle memory when opening files, leading to memory corruption. This vulnerability, dubbed "Excel Memory Corruption Using Various Modified Bytes Vulnerability," is triggered by a specially crafted spreadsheet. Affected versions include Excel 2003 SP3 and Office 2008 for Mac [1].

Exploitation

An attacker can exploit this vulnerability by convincing a user to open a malicious spreadsheet file. No authentication is required, and the attack is remote. The user must open the file, which can be delivered via email or web download.

Impact

Successful exploitation allows remote code execution with the same privileges as the logged-on user. If the user has administrative rights, the attacker can gain full control of the system. This compromises confidentiality, integrity, and availability [1].

Mitigation

Microsoft released security update MS12-030 in May 2012 to address this vulnerability. Users should apply the update via Windows Update or manual download [1]. US-CERT also recommends applying updates [2].