9.3 - MS13-091

Executive Summary

Summary
Title	Vulnerabilities in Microsoft Office Could Allow Remote Code Execution

Informations
Name	MS13-091	First vendor Publication	2013-11-12
Vendor	Microsoft	Last vendor Modification	2013-11-12
Severity (Vendor)	Version	Revision	1.0

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score	9.3	Attack Range	Network
Cvss Impact Score	10	Attack Complexity	Medium
Cvss Expoit Score	8.6	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Severity Rating: Important
Revision Note: V1.0 (November 12, 2013): Bulletin published.
Summary: This security update resolves three privately reported vulnerabilities in Microsoft Office. The vulnerabilities could allow remote code execution if a specially crafted WordPerfect document file is opened in an affected version of Microsoft Office software. An attacker who successfully exploited the most severe vulnerabilities could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Original Source

Url : https://technet.microsoft.com/en-us/library/security/MS13-091

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-119	Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:19162

Oval ID:	oval:org.mitre.oval:def:19162
Title:	Word Stack Buffer Overwrite Vulnerability in Microsoft Office (CVE-2013-1324) - MS13-091
Description:	Stack-based buffer overflow in Microsoft Office 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT allows remote attackers to execute arbitrary code via a crafted WordPerfect document (.wpd) file, aka "Word Stack Buffer Overwrite Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-1324	Version:	8
Platform(s):	Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2012 Microsoft Windows Server 2012 R2 Microsoft Windows 7 Microsoft Windows Vista Microsoft Windows 8 Microsoft Windows 8.1	Product(s):	Microsoft Office 2003 Microsoft Office 2007 Microsoft Office 2010 Microsoft Office 2013
Definition Synopsis:
For Office 2007 and its vulnerable file Microsoft Office 2007 SP3 is installed AND Check if the version of Wpft532.cnv is greater than or equal to 2006.1200.0000.0000 AND Check if the version of Wpft532.cnv is less than 2006.1200.6659.5000 OR For Office 2003 and its vulnerable file Microsoft Office 2003 SP3 is installed AND Check if the version of MSCONV97.DLL is less than 2003.1100.8327.0 OR For Office 2010 and its vulnerable file For Office 2010 Microsoft Office 2010 SP1 is installed AND Microsoft Office 2010 SP2 is installed AND Check if the version of Wpft532.cnv is greater than or equal 2010.1400.0000.0000 AND Check if the version of Wpft532.cnv is less than 2010.1400.7011.1000 OR For Office 2013 and its vulnerable file Microsoft Office 2013 is installed AND Check if the version of Wpft532.cnv is greater than or equal to 2012.1500.0000.0000 and less than 2012.1500.4525.1000

Definition Id: oval:org.mitre.oval:def:19178

Oval ID:	oval:org.mitre.oval:def:19178
Title:	WPD File Format Memory Corruption Vulnerability in Microsoft Office (CVE-2013-0082) - MS13-091
Description:	Microsoft Office 2003 SP3 and 2007 SP3 allows remote attackers to execute arbitrary code via a crafted WordPerfect document (.wpd) file, aka "WPD File Format Memory Corruption Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-0082	Version:	5
Platform(s):	Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows 7	Product(s):	Microsoft Office 2003 Microsoft Office 2007
Definition Synopsis:
For Office 2007 and vulnerable file Microsoft Office 2007 SP3 is installed AND Check if the version of Wpft532.cnv is greater than or equal to 2006.1200.0000.0000 AND Check if the version of Wpft532.cnv is less than 2006.1200.6659.5000 OR For Office 2003 and vulnerable file Microsoft Office 2003 SP3 is installed AND Check if the version of MSCONV97.DLL is less than 2003.1100.8327.0

Definition Id: oval:org.mitre.oval:def:19321

Oval ID:	oval:org.mitre.oval:def:19321
Title:	Word Heap Overwrite Vulnerability in Microsoft Office (CVE-2013-1325) - MS13-091
Description:	Heap-based buffer overflow in Microsoft Office 2003 SP3 and 2007 SP3 allows remote attackers to execute arbitrary code via a crafted WordPerfect document (.wpd) file, aka "Word Heap Overwrite Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-1325	Version:	5
Platform(s):	Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows 7	Product(s):	Microsoft Office 2003 Microsoft Office 2007
Definition Synopsis:
For Office 2007 and vulnerable file Microsoft Office 2007 SP3 is installed AND Check if the version of Wpft532.cnv is greater than or equal to 2006.1200.0000.0000 AND Check if the version of Wpft532.cnv is less than 2006.1200.6659.5000 OR For Office 2003 and vulnerable file Microsoft Office 2003 SP3 is installed AND Check if the version of MSCONV97.DLL is less than 2003.1100.8327.0

CPE : Common Platform Enumeration

Type	Description	Count
Application	Microsoft Office cpe:2.3:a:microsoft:office:2013:-:-::-:-:x86: cpe:2.3:a:microsoft:office:2013:-:-::-:-:x64: cpe:2.3:a:microsoft:office:2010:sp1:x64:::::* cpe:2.3:a:microsoft:office:2010:sp1:x86:::::* cpe:2.3:a:microsoft:office:2007:sp3:::::: cpe:2.3:a:microsoft:office:2003:sp3::::::	6
Application	Microsoft Office 2013 Rt cpe:2.3:a:microsoft:office_2013_rt:-:::::::*	1

Information Assurance Vulnerability Management (IAVM)

Date	Description
2013-11-14	IAVM : 2013-B-0126 - Multiple Vulnerabilities in Microsoft Office Severity : Category II - VMSKEY : V0042306

Snort® IPS/IDS

Date	Description
2016-03-14	Microsoft Word WordPerfect CSTYL border element stack overflow attempt RuleID : 36501 - Revision : 3 - Type : FILE-OTHER
2016-03-14	Microsoft Word WordPerfect CSTYL border element stack overflow attempt RuleID : 36500 - Revision : 4 - Type : FILE-OTHER
2016-03-14	Microsoft Word WordPerfect CSTYL border element stack overflow attempt RuleID : 36499 - Revision : 2 - Type : FILE-OTHER
2016-03-14	Microsoft Word WordPerfect CSTYL border element stack overflow attempt RuleID : 36498 - Revision : 2 - Type : FILE-OTHER
2014-01-10	Microsoft Word WordPerfect CSTYL border element stack overflow attempt RuleID : 28503 - Revision : 3 - Type : FILE-OTHER
2014-01-10	Microsoft Word WordPerfect CSTYL border element stack overflow attempt RuleID : 28502 - Revision : 3 - Type : FILE-OTHER
2014-01-10	WordPerfect file magic with .doc extension RuleID : 28501 - Revision : 2 - Type : FILE-OTHER
2014-01-10	WordPerfect file magic with .doc extension RuleID : 28500 - Revision : 2 - Type : FILE-OTHER
2014-01-10	Microsoft Word WordPerfect CSTYL border element stack overflow attempt RuleID : 28499 - Revision : 3 - Type : FILE-OTHER
2014-01-10	Microsoft Word WordPerfect CSTYL border element stack overflow attempt RuleID : 28498 - Revision : 3 - Type : FILE-OTHER

Nessus® Vulnerability Scanner

Date	Description
2013-11-13	Name : The Microsoft Office component installed on the remote host is affected by mu... File : smb_nt_ms13-091.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2016-04-27 02:03:23	Multiple Updates
2014-05-06 11:35:10	Multiple Updates
2014-05-06 11:34:15	Multiple Updates
2014-04-19 00:26:09	Multiple Updates
2014-04-19 00:19:16	Multiple Updates
2014-04-18 21:28:39	Multiple Updates
2014-04-18 21:20:36	Multiple Updates
2014-04-18 17:26:24	Multiple Updates
2014-04-18 17:19:38	Multiple Updates
2014-04-18 09:27:11	Multiple Updates
2014-04-18 09:20:00	Multiple Updates
2014-04-18 05:28:03	Multiple Updates
2014-04-18 05:21:03	Multiple Updates
2014-04-18 00:26:22	Multiple Updates
2014-04-18 00:19:37	Multiple Updates
2014-04-17 21:26:00	Multiple Updates
2014-04-17 21:20:08	Multiple Updates
2014-04-17 17:26:39	Multiple Updates
2014-04-17 17:19:34	Multiple Updates
2014-04-17 13:29:33	Multiple Updates
2014-04-17 13:20:40	Multiple Updates
2014-04-17 09:08:01	Multiple Updates
2014-02-17 11:47:51	Multiple Updates
2014-01-19 21:31:00	Multiple Updates
2013-11-15 21:21:00	Multiple Updates
2013-11-13 17:21:26	Multiple Updates
2013-11-13 13:22:05	Multiple Updates
2013-11-12 21:17:08	First insertion

Global Informations

Type	Count
CWE ID(s)	3
Oval ID(s)	3
CPE ID(s)	7
IAVM(s)	1
Snort® Rule(s)	10
Nessus® Exploit(s)	1

	Related
10	MS13-105
10	MS13-083
10	MS13-067
10	MS13-062
10	MS13-042
10	MS13-015
10	MS13-001
9.3	MS15-059
9.3	MS14-023
9.3	MS13-099
9.3	MS13-097
9.3	MS13-096
9.3	MS13-090
9.3	MS13-089
9.3	MS13-088
9.3	MS13-086
9.3	MS13-085
9.3	MS13-084
9.3	MS13-082
9.3	MS13-081
9.3	MS13-080
9.3	MS13-074
9.3	MS13-073
9.3	MS13-072
9.3	MS13-071
9.3	MS13-070
9.3	MS13-069
9.3	MS13-068
9.3	MS13-060
9.3	MS13-059
9.3	MS13-057
9.3	MS13-056
9.3	MS13-055
9.3	MS13-054
9.3	MS13-053
9.3	MS13-052
9.3	MS13-051
9.3	MS13-047
9.3	MS13-043
9.3	MS13-041
9.3	MS13-038
9.3	MS13-037
9.3	MS13-029
9.3	MS13-028
9.3	MS13-023
9.3	MS13-022
9.3	MS13-021
9.3	MS13-020
9.3	MS13-011
9.3	MS13-010
9.3	MS13-009
9.3	MS13-008
9.3	MS13-004
9.3	MS13-002
9.3	MS09-073
9.3	CVE-2013-1325
9.3	CVE-2013-1324
9.3	CVE-2013-0082
9	MS13-050
7.9	MS13-092
7.8	MS13-065
7.8	MS13-064
7.8	MS13-039
7.8	MS13-024
7.8	MS13-018
7.8	MS13-007
7.6	MS13-098
7.5	MS13-063
7.5	MS13-040
7.2	MS13-101
7.2	MS13-076
7.2	MS13-046
7.2	MS13-034
7.2	MS13-033
7.2	MS13-027
7.2	MS13-019
7.2	MS13-017
7.2	MS13-005
7.1	MS13-049
7.1	MS13-036
7.1	MS13-014
6.9	MS13-102
6.9	MS13-077
6.9	MS13-075
6.9	MS13-058
6.8	MS13-100
6.8	MS13-061
6.8	MS13-045
6.8	MS13-012
5.8	MS13-006
5	MS13-095
5	MS13-094
5	MS13-079
5	MS13-066
5	MS13-032
5	MS13-026
5	MS13-025
4.9	MS13-093
4.9	MS13-031
4.9	MS13-016
4.4	MS13-048
4.3	MS13-106
4.3	MS13-104
4.3	MS13-103
4.3	MS13-087
4.3	MS13-078
4.3	MS13-044
4.3	MS13-035
4.3	MS13-003
3.5	MS13-030
2.1	MS13-013
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 111 more Alert(s)

9.3 - MS13-091

Executive Summary

Security-Database Scoring CVSS v3

Security-Database Scoring CVSS v2

Detail

Original Source

CWE : Common Weakness Enumeration

OVAL Definitions

CPE : Common Platform Enumeration

Information Assurance Vulnerability Management (IAVM)

Snort® IPS/IDS

Nessus® Vulnerability Scanner

Alert History

Global Informations

Open Standards

Other Databases

COMPANY

STANDARDS

RECENT POSTS

MENU