Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Summary | |
|---|---|
| Title | Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (2489279) |
| Informations | |||
|---|---|---|---|
| Name | MS11-021 | First vendor Publication | 2011-04-12 |
| Vendor | Microsoft | Last vendor Modification | 2011-04-12 |
| Severity (Vendor) | Important | Revision | 1.0 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 9.3 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Revision Note: V1.0 (April 12, 2011): Bulletin published.Summary: This security update resolves nine privately reported vulnerabilities in Microsoft Office. The vulnerabilities could allow remote code execution if a user opens a specially crafted Excel file. An attacker who successfully exploited any of these vulnerabilities could gain the same user rights as the logged-on user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. |
Original Source
| Url : http://www.microsoft.com/technet/security/bulletin/MS11-021.mspx |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 56 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
| 22 % | CWE-189 | Numeric Errors (CWE/SANS Top 25) |
| 11 % | CWE-264 | Permissions, Privileges, and Access Controls |
| 11 % | CWE-20 | Improper Input Validation |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:11676 | |||
| Oval ID: | oval:org.mitre.oval:def:11676 | ||
| Title: | Excel Record Parsing WriteAV Vulnerability | ||
| Description: | Microsoft Excel 2002 SP3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted RealTimeData record, related to a stTopic field, doubly-byte characters, and an incorrect pointer calculation, aka "Excel Record Parsing WriteAV Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2011-0101 | Version: | 6 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows 7 | Product(s): | Microsoft Excel 2002 |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:11767 | |||
| Oval ID: | oval:org.mitre.oval:def:11767 | ||
| Title: | Excel Buffer Overwrite Vulnerability | ||
| Description: | Microsoft Excel 2002 SP3 and 2003 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted HLink record in an Excel file, aka "Excel Buffer Overwrite Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2011-0104 | Version: | 6 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows 7 | Product(s): | Microsoft Excel 2002 Microsoft Excel 2003 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:12018 | |||
| Oval ID: | oval:org.mitre.oval:def:12018 | ||
| Title: | Excel Dangling Pointer Vulnerability | ||
| Description: | Microsoft Excel 2002 SP3 and 2003 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac do not properly parse Office Art objects, which allows remote attackers to execute arbitrary code via vectors related to a function pointer, aka "Excel Dangling Pointer Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2011-0980 | Version: | 6 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows 7 | Product(s): | Microsoft Excel 2002 Microsoft Excel 2003 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:12034 | |||
| Oval ID: | oval:org.mitre.oval:def:12034 | ||
| Title: | Excel Heap Overflow Vulnerability | ||
| Description: | Integer signedness error in Microsoft Excel 2002 SP3, 2003 SP3, 2007 SP2, and 2010; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Excel Viewer SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2 allows remote attackers to execute arbitrary code via an XLS file with a large record size, aka "Excel Heap Overflow Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2011-0098 | Version: | 12 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows 7 | Product(s): | Microsoft Excel 2002 Microsoft Excel 2003 Microsoft Excel 2010 Microsoft Office Excel Viewer Microsoft Office Compatibility Pack |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:12439 | |||
| Oval ID: | oval:org.mitre.oval:def:12439 | ||
| Title: | Excel Array Indexing Vulnerability | ||
| Description: | Stack-based buffer overflow in Microsoft Excel 2002 SP3, 2003 SP3, and 2007 SP2; Office 2004 for Mac; Excel Viewer SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2 allows remote attackers to execute arbitrary code via vectors related to an axis properties record, and improper incrementing of an array index, aka "Excel Array Indexing Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2011-0978 | Version: | 11 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows 7 | Product(s): | Microsoft Excel 2002 Microsoft Excel 2003 Microsoft Office Excel Viewer Microsoft Office Compatibility Pack |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:12595 | |||
| Oval ID: | oval:org.mitre.oval:def:12595 | ||
| Title: | Excel Linked List Corruption Vulnerability | ||
| Description: | Microsoft Excel 2002 SP3, 2003 SP3, 2007 SP2, and 2010; Office 2004, 2008, and 2011 for Mac; Open XML File Format Converter for Mac; and Excel Viewer SP2 do not properly handle errors during the parsing of Office Art records in Excel spreadsheets, which allows remote attackers to execute arbitrary code via a malformed object record, related to a "stray reference," aka "Excel Linked List Corruption Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2011-0979 | Version: | 9 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows 7 | Product(s): | Microsoft Excel 2002 Microsoft Excel 2003 Microsoft Excel 2010 Microsoft Office Excel Viewer |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:12612 | |||
| Oval ID: | oval:org.mitre.oval:def:12612 | ||
| Title: | Excel Integer Overrun Vulnerability | ||
| Description: | Integer underflow in Microsoft Excel 2002 SP3, 2003 SP3, 2007 SP2, and 2010; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Excel Viewer SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2 allows remote attackers to execute arbitrary code via a crafted 400h substream in an Excel file, which triggers a stack-based buffer overflow, aka "Excel Integer Overrun Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2011-0097 | Version: | 12 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows 7 | Product(s): | Microsoft Excel 2002 Microsoft Excel 2003 Microsoft Excel 2010 Microsoft Office Excel Viewer Microsoft Office Compatibility Pack |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:12616 | |||
| Oval ID: | oval:org.mitre.oval:def:12616 | ||
| Title: | Excel Memory Corruption Vulnerability | ||
| Description: | Microsoft Excel 2002 SP3 and 2003 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted record information in an Excel file, aka "Excel Memory Corruption Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2011-0103 | Version: | 5 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows 7 | Product(s): | Microsoft Excel 2002 Microsoft Excel 2003 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:12618 | |||
| Oval ID: | oval:org.mitre.oval:def:12618 | ||
| Title: | Excel Data Initialization Vulnerability | ||
| Description: | Microsoft Excel 2002 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac obtain a certain length value from an uninitialized memory location, which allows remote attackers to trigger a buffer overflow and execute arbitrary code via a crafted Excel file, aka "Excel Data Initialization Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2011-0105 | Version: | 5 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows 7 | Product(s): | Microsoft Excel 2002 |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 6 | |
| Application | 1 | |
| Application | 3 | |
| Application | 1 | |
| Application | 1 |
SAINT Exploits
| Description | Link |
|---|---|
| Microsoft Excel Substream Parsing Integer Overflow | More info here |
| Microsoft Excel Data Validation Record Parsing Overflow | More info here |
ExploitDB Exploits
| id | Description |
|---|---|
| 2011-11-05 | MS11-021 Microsoft Office 2007 Excel .xlb Buffer Overflow |
| 2011-11-02 | Microsoft Excel 2007 SP2 Buffer Overwrite Exploit |
| 2011-04-29 | Microsoft Office Excel Axis Properties Record Parsing Buffer Overflow PoC |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2011-04-13 | Name : Microsoft Office Excel Remote Code Execution Vulnerabilities (2489279) File : nvt/secpod_ms11-021.nasl |
| 2011-02-23 | Name : Microsoft Office Excel 2003 Invalid Object Type Remote Code Execution Vulnera... File : nvt/gb_ms_office_excel_art_object_code_exec_vuln.nasl |
| 2011-02-23 | Name : Microsoft Office Excel Axis and Art Object Parsing Remote Code Execution Vuln... File : nvt/gb_ms_office_excel_mult_code_exec_vuln.nasl |
| 2011-02-23 | Name : Microsoft PowerPoint 2007 OfficeArt Atom Remote Code Execution Vulnerability File : nvt/gb_ms_power_point_code_exec_vuln.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 71766 | Microsoft Office Excel RealTimeData Record Parsing WriteAV Remote Code Execution Microsoft Excel contains a flaw related to RealTimeData Record Parsing methods. The issue is triggered when a the program uses an improperly calculated pointer in a memcpy operation with a user supplied data source. This may allow a context-dependent attacker to use a crafted Excel file to execute arbitrary code. |
| 71765 | Microsoft Office Excel File Validation Record Handling Overflow Microsoft Excel, Office for Mac, and Open XML File Format Converter for Mac are prone to an overflow condition. The programs fail to properly sanitize user-supplied input resulting in a buffer overflow. With a specially crafted record within a Microsoft Excel Compound document, a context-dependent attacker can potentially execute arbitrary code. |
| 71764 | Microsoft Office Excel File Handling Dangling Pointer Remote Code Execution Microsoft Excel, Office for Mac, and Open XML File Format Converter for Mac contain a flaw related to improper parsing of office art object. The issue is triggered when the program adds the object to a linked list and trusts a function pointer of the object. This may allow a context-dependent attacker using a crafted Excel document to replace this pointer to execute arbitrary code. |
| 71763 | Microsoft Office Excel File Handling Linked List Corruption Remote Code Execu... Multiple Microsoft products contain a flaw related to improper error handling in office art object records. The issue is triggered when the program receives a window message and navigates to a linked list which accesses a malformed object. This may allow a context-dependent attacker to execute arbitrary code. |
| 71762 | Microsoft Excel Axis Properties Record Parsing Overflow Microsoft Excel is prone to an overflow condition. The program fails to properly sanitize user-supplied input, specifically a specific field used in array index incrementing, resulting in a stack-based buffer overflow. With a specially crafted axis properties record in an Excel file, a context-dependent attacker can potentially execute arbitrary code. |
| 71761 | Microsoft Office Excel File Handling Memory Corruption A memory corruption flaw exists in Microsoft Excel, Office for Mac, and Open XML File Format Converter for Mac. The programs fail to sanitize user-supplied input while validating record information during parsing of Excel files, resulting in memory corruption. With a specially crafted Excel file, a context-dependent attacker can execute arbitrary code. |
| 71760 | Microsoft Office Excel File Handling Unspecified Memory Corruption A memory corruption flaw exists in Microsoft Excel, Office for Mac, and Open XML File Format Converter for Mac. The programs fail to sanitize user-supplied input while parsing an Excel file containing certain unspecified specific values, resulting in memory corruption. With a specially crafted Excel file, a context-dependent attacker can execute arbitrary code. |
| 71759 | Microsoft Excel External Record Parsing Signedness Overflow Multiple Microsoft products are prone to an overflow condition. The programs fails to properly sanitize user-supplied input and encounter a signedness error, resulting in a heap-based buffer overflow. With specially crafted record information in an Excel file, a context-dependent attacker can potentially execute arbitrary code. |
| 71758 | Microsoft Excel Substream Parsing Integer Underflow Multiple Microsoft products are prone to an overflow condition. The programs encounter an integer underflow error when parsing data included in a 400h substream, resulting in a stack-based buffer overflow. With specially crafted crafted record information in an Excel file, a context-dependent attacker can potentially execute arbitrary code/ |
| 70904 | Microsoft Office Excel OfficeArt Container Parsing Memory Corruption A memory corruption flaw exists in Microsoft Office Excel. The program fails to properly handle errors during Office Art record parsing, resulting in memory corruption. With a specially crafted Excel document, a context-dependent attacker can execute arbitrary code. |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2014-01-10 | Microsoft Office Excel url unicode overflow attempt RuleID : 7002 - Revision : 20 - Type : FILE-OFFICE |
| 2015-01-31 | Microsoft Office Excel malformed Label record exploit attempt RuleID : 32940 - Revision : 4 - Type : FILE-OFFICE |
| 2015-01-06 | Microsoft Office Excel DV record buffer overflow attempt RuleID : 32625 - Revision : 3 - Type : FILE-OFFICE |
| 2014-07-03 | Microsoft Office Excel rtToolbarDef record integer overflow attempt RuleID : 31127 - Revision : 3 - Type : FILE-OFFICE |
| 2014-07-03 | Microsoft Office Excel rtToolbarDef record integer overflow attempt RuleID : 31126 - Revision : 3 - Type : FILE-OFFICE |
| 2014-07-03 | Microsoft Office Excel rtToolbarDef record integer overflow attempt RuleID : 31125 - Revision : 3 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office Excel rtToolbarDef record integer overflow attempt RuleID : 28550 - Revision : 4 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office Excel rtToolbarDef record integer overflow attempt RuleID : 28549 - Revision : 4 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office Excel RealTimeData record memory corruption attempt RuleID : 28546 - Revision : 4 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office Excel RealTimeData record memory corruption attempt RuleID : 28545 - Revision : 3 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office Excel RealTimeData record memory corruption attempt RuleID : 28544 - Revision : 3 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office Excel Workspace file FontCount record memory corruption attempt RuleID : 28103 - Revision : 4 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office Excel IPMT record buffer overflow attempt RuleID : 25296 - Revision : 4 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office Excel IPMT record buffer overflow attempt RuleID : 25295 - Revision : 3 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office Excel IPMT record buffer overflow attempt RuleID : 25294 - Revision : 4 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office Excel IPMT record buffer overflow attempt RuleID : 25293 - Revision : 6 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office Excel catLabel pointer manipulation attempt RuleID : 24130 - Revision : 5 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office Excel catLabel pointer manipulation attempt RuleID : 24129 - Revision : 6 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office Excel rtToolbarDef record integer overflow attempt RuleID : 20534 - Revision : 12 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office Excel DV record buffer overflow attempt RuleID : 18676 - Revision : 11 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office Excel OBJ record invalid cmo.ot exploit attempt RuleID : 18641 - Revision : 7 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office Excel malformed SupBook record attempt RuleID : 18640 - Revision : 8 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office Excel CatSerRange record exploit attempt RuleID : 18639 - Revision : 12 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office Excel Workspace file FontCount record memory corruption attempt RuleID : 18634 - Revision : 15 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office Excel RealTimeData record memory corruption attempt RuleID : 18633 - Revision : 14 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office Excel malformed Label record exploit attempt RuleID : 18632 - Revision : 19 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office Excel rtToolbarDef record integer overflow attempt RuleID : 18631 - Revision : 11 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office Excel rtToolbarDef record integer overflow attempt RuleID : 18630 - Revision : 11 - Type : FILE-OFFICE |
Metasploit Database
| id | Description |
|---|---|
| 2011-08-09 | MS11-021 Microsoft Office 2007 Excel .xlb Buffer Overflow |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2011-04-13 | Name : An application installed on the remote Mac OS X host is affected by multiple ... File : macosx_ms_office_apr2011.nasl - Type : ACT_GATHER_INFO |
| 2011-04-13 | Name : Arbitrary code can be executed on the remote host through Microsoft Excel. File : smb_nt_ms11-021.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2020-05-23 13:17:13 |
|
| 2016-04-26 23:03:14 |
|
| 2015-01-31 21:23:54 |
|
| 2015-01-06 21:48:45 |
|
| 2014-07-03 21:24:06 |
|
| 2014-03-20 21:21:09 |
|
| 2014-02-17 11:46:54 |
|
| 2014-01-19 21:30:38 |
|
