Executive Summary
Summary | |
---|---|
Title | Vulnerability in Microsoft Office Outlook Could Allow Remote Code Execution (978212) |
Informations | |||
---|---|---|---|
Name | MS10-045 | First vendor Publication | 2010-07-13 |
Vendor | Microsoft | Last vendor Modification | 2010-07-14 |
Severity (Vendor) | Important | Revision | 1.1 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
---|---|---|---|
Cvss Base Score | 9.3 | Attack Range | Network |
Cvss Impact Score | 10 | Attack Complexity | Medium |
Cvss Expoit Score | 8.6 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Revision Note: V1.1 (July 14, 2010): Added a link to Microsoft Knowledge Base Article 978212 under Known Issues in the Executive Summary.Summary: This security update resolves a privately reported vulnerability. The vulnerability could allow remote code execution if a user opened an attachment in a specially crafted e-mail message using an affected version of Microsoft Office Outlook. An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. |
Original Source
Url : http://www.microsoft.com/technet/security/bulletin/MS10-045.mspx |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-94 | Failure to Control Generation of Code ('Code Injection') |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:11623 | |||
Oval ID: | oval:org.mitre.oval:def:11623 | ||
Title: | Microsoft Outlook SMB Attachment Vulnerability | ||
Description: | Microsoft Office Outlook 2002 SP3, 2003 SP3, and 2007 SP1 and SP2 does not properly verify e-mail attachments with a PR_ATTACH_METHOD property value of ATTACH_BY_REFERENCE, which allows user-assisted remote attackers to execute arbitrary code via a crafted message, aka "Microsoft Outlook SMB Attachment Vulnerability." | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2010-0266 | Version: | 5 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Vista Microsoft Windows 7 | Product(s): | Microsoft Outlook 2002 Microsoft Outlook 2003 Microsoft Outlook 2007 |
Definition Synopsis: | |||
|
CPE : Common Platform Enumeration
Type | Description | Count |
---|---|---|
Application | 4 |
SAINT Exploits
Description | Link |
---|---|
Microsoft Outlook SMB Attachment ATTACH_BY_REFERENCE vulnerability | More info here |
ExploitDB Exploits
id | Description |
---|---|
2010-09-20 | Outlook ATTACH_BY_REF_ONLY File Execution |
2010-09-20 | Outlook ATTACH_BY_REF_RESOLVE File Execution |
OpenVAS Exploits
Date | Description |
---|---|
2010-07-14 | Name : Microsoft Outlook SMB Attachment Remote Code Execution Vulnerability (978212) File : nvt/secpod_ms10-045.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
66296 | Microsoft Outlook SMB Attachment Handling Arbitrary Program Execution Microsoft Office Outlook contains a flaw related to a failure to verify e-mail attachments properly. The issue is triggered when the program allows attachments to link to files other than what they appear to be. This may allow a context-dependent attacker to use a crafted message to execute arbitrary code. |
Information Assurance Vulnerability Management (IAVM)
Date | Description |
---|---|
2010-07-15 | IAVM : 2010-A-0093 - Microsoft Office Outlook Remote Code Execution Vulnerability Severity : Category II - VMSKEY : V0024852 |
Snort® IPS/IDS
Date | Description |
---|---|
2017-11-28 | Microsoft Office Outlook SMB attach by reference code execution attempt RuleID : 44670 - Revision : 1 - Type : FILE-OFFICE |
2017-11-28 | Microsoft Office Outlook SMB attach by reference code execution attempt RuleID : 44669 - Revision : 1 - Type : FILE-OFFICE |
2016-03-22 | Microsoft Office Outlook SMB attach by reference code execution attempt RuleID : 37699 - Revision : 4 - Type : FILE-OFFICE |
2016-03-22 | Microsoft Office Outlook AttachMethods local file execution attempt RuleID : 37698 - Revision : 2 - Type : FILE-OFFICE |
2016-03-22 | Microsoft Office Outlook AttachMethods local file execution attempt RuleID : 37697 - Revision : 2 - Type : FILE-OFFICE |
2016-03-22 | Microsoft Office Outlook SMB attach by reference code execution attempt RuleID : 37696 - Revision : 2 - Type : FILE-OFFICE |
2016-03-22 | Microsoft Office Outlook SMB attach by reference code execution attempt RuleID : 37695 - Revision : 2 - Type : FILE-OFFICE |
2016-03-22 | Microsoft Office Outlook AttachMethods local file execution attempt RuleID : 37694 - Revision : 2 - Type : FILE-OFFICE |
2016-03-22 | Microsoft Office Outlook AttachMethods local file execution attempt RuleID : 37693 - Revision : 2 - Type : FILE-OFFICE |
2016-03-22 | Microsoft Office Outlook SMB attach by reference code execution attempt RuleID : 37692 - Revision : 2 - Type : FILE-OFFICE |
2016-03-22 | Microsoft Office Outlook SMB attach by reference code execution attempt RuleID : 37691 - Revision : 2 - Type : FILE-OFFICE |
2014-01-10 | Microsoft Office Outlook SMB attach by reference code execution attempt RuleID : 20247 - Revision : 16 - Type : FILE-OFFICE |
2014-01-10 | Microsoft Office Outlook SMB attach by reference code execution attempt RuleID : 20246 - Revision : 16 - Type : FILE-OFFICE |
2014-01-10 | Microsoft Office Outlook SMB attach by reference code execution attempt RuleID : 19407 - Revision : 13 - Type : FILE-OFFICE |
2014-01-10 | Microsoft Office Outlook SMB attach by reference code execution attempt RuleID : 19406 - Revision : 14 - Type : FILE-OFFICE |
2014-01-10 | Microsoft Office Outlook SMB attach by reference code execution attempt RuleID : 19405 - Revision : 14 - Type : FILE-OFFICE |
2014-01-10 | Microsoft Office Outlook AttachMethods local file execution attempt RuleID : 17036 - Revision : 14 - Type : FILE-OFFICE |
2014-01-10 | Microsoft Office Outlook AttachMethods local file execution attempt RuleID : 17035 - Revision : 13 - Type : FILE-OFFICE |
2014-01-10 | Microsoft Office Outlook AttachMethods local file execution attempt RuleID : 17034 - Revision : 14 - Type : FILE-OFFICE |
Metasploit Database
id | Description |
---|---|
2010-06-01 | Outlook ATTACH_BY_REF_RESOLVE File Execution |
2010-06-01 | Outlook ATTACH_BY_REF_ONLY File Execution |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2010-07-13 | Name : The version of Microsoft Office installed on the remote Windows host has a co... File : smb_nt_ms10-045.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2020-05-23 13:17:13 |
|
2014-02-17 11:46:36 |
|
2014-01-19 21:30:29 |
|
2013-11-11 12:41:18 |
|