====================================================================

                             CERT-Renater

                  Note d'Information No. 2012/VULN331
____________________________________________________________________

DATE                :  16/08/2012

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S) : Systems running Microsoft Office versions 2007,
                                          2010.

======================================================================
KB2731879
http://technet.microsoft.com/en-us/security/bulletin/MS12-057
______________________________________________________________________


Microsoft Security Bulletin MS12-057 - Important Vulnerability in
Microsoft Office Could Allow for Remote Code Execution (2731879)

Published Date: August 14, 2012

Version: 1.0

General Information


Executive Summary

This security update resolves one privately reported vulnerability in
Microsoft Office. The vulnerability could allow remote code execution
if a user opens specially crafted file or embeds a specially crafted .
Computer Graphics Metafile (CGM) graphics file in to an Office file. An
attacker who successfully exploited this vulnerability could gain the
same user rights as the current user. Users whose accounts are
configured to have fewer user rights on the system could be less
impacted than users who operate with administrative user rights.

This security update is rated Important for all supported editions of
Microsoft Office 2007 and Microsoft Office 2010. For more information,
see the subsection, Affected and Non-Affected Software, in this section.


Affected Software

Microsoft Office 2007 Service Pack 2
Microsoft Office 2007 Service Pack 3
Microsoft Office 2010 Service Pack 1 (32-bit editions)
Microsoft Office 2010 Service Pack 1 (64-bit editions)


Vulnerability Information

CGM File Format Memory Corruption Vulnerability - CVE-2012-2524

A remote code execution vulnerability exists in the way that Microsoft
Office handles specially crafted Computer Graphics Metafile (CGM)
graphics files. An attacker who successfully exploited this
vulnerability could take complete control of an affected system. An
attacker could then install programs; view, change, or delete data; or
create new accounts with full user rights.

======================================================================

=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
=========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44          +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41          +
+ 75013 Paris           | email: certsvp@renater.fr     +
=========================================================