Executive Summary
Summary | |
---|---|
Title | Vulnerabilities in Microsoft Word Could Allow Remote Code Execution (2293194) |
Informations | |||
---|---|---|---|
Name | MS10-079 | First vendor Publication | 2010-10-12 |
Vendor | Microsoft | Last vendor Modification | 2010-11-03 |
Severity (Vendor) | Important | Revision | 1.2 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
---|---|---|---|
Cvss Base Score | 9.3 | Attack Range | Network |
Cvss Impact Score | 10 | Attack Complexity | Medium |
Cvss Expoit Score | 8.6 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Revision Note: V1.2 (November 3, 2010): Corrected the bulletin replacement information for the Microsoft Word Viewer update (KB2345009). This is an informational change only. There were no changes to the detection logic or the update files.Summary: This security update resolves eleven privately reported vulnerabilities in Microsoft Office. The vulnerabilities could allow remote code execution if a user opens a specially crafted Word file. An attacker who successfully exploited any of these vulnerabilities could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. |
Original Source
Url : http://www.microsoft.com/technet/security/bulletin/MS10-079.mspx |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
82 % | CWE-94 | Failure to Control Generation of Code ('Code Injection') |
9 % | CWE-399 | Resource Management Errors |
9 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:6695 | |||
Oval ID: | oval:org.mitre.oval:def:6695 | ||
Title: | Word Pointer Vulnerability | ||
Description: | Double free vulnerability in Microsoft Word 2002 SP3 allows remote attackers to execute arbitrary code via a Word document with crafted List Format Override (LFO) records, aka "Word Pointer Vulnerability." | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2010-3217 | Version: | 7 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows 7 | Product(s): | Microsoft Word 2002 |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:6792 | |||
Oval ID: | oval:org.mitre.oval:def:6792 | ||
Title: | Word Parsing Vulnerability | ||
Description: | Unspecified vulnerability in Microsoft Word 2002 SP3 and Office 2004 for Mac allows remote attackers to execute arbitrary code via a crafted Word document that triggers memory corruption, aka "Word Parsing Vulnerability." | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2010-3220 | Version: | 6 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows 7 | Product(s): | Microsoft Word 2002 |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:6974 | |||
Oval ID: | oval:org.mitre.oval:def:6974 | ||
Title: | Word Return Value Vulnerability | ||
Description: | Microsoft Word 2002 SP3 and Office 2004 for Mac do not properly handle unspecified return values during parsing of a Word document, which allows remote attackers to execute arbitrary code via a crafted document that triggers memory corruption, aka "Word Return Value Vulnerability." | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2010-3215 | Version: | 6 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows 7 | Product(s): | Microsoft Word 2002 |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:7010 | |||
Oval ID: | oval:org.mitre.oval:def:7010 | ||
Title: | Word Heap Overflow Vulnerability | ||
Description: | Heap-based buffer overflow in Microsoft Word 2002 SP3 allows remote attackers to execute arbitrary code via malformed records in a Word document, aka "Word Heap Overflow Vulnerability." | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2010-3218 | Version: | 6 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows 7 | Product(s): | Microsoft Word 2002 |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:7019 | |||
Oval ID: | oval:org.mitre.oval:def:7019 | ||
Title: | Word Index Parsing Vulnerability | ||
Description: | Array index vulnerability in Microsoft Word 2002 SP3 allows remote attackers to execute arbitrary code via a crafted Word document that triggers memory corruption, aka "Word Index Parsing Vulnerability." | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2010-3219 | Version: | 6 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows 7 | Product(s): | Microsoft Word 2002 |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:7032 | |||
Oval ID: | oval:org.mitre.oval:def:7032 | ||
Title: | Word Parsing Vulnerability | ||
Description: | Microsoft Word 2002 SP3 and 2003 SP3, Office 2004 for Mac, and Word Viewer do not properly handle a malformed record during parsing of a Word document, which allows remote attackers to execute arbitrary code via a crafted document that triggers memory corruption, aka "Word Parsing Vulnerability." | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2010-3221 | Version: | 9 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows 7 | Product(s): | Microsoft Word 2002 Microsoft Word 2003 Microsoft Office Word Viewer |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:7121 | |||
Oval ID: | oval:org.mitre.oval:def:7121 | ||
Title: | Word Uninitialized Pointer Vulnerability | ||
Description: | Microsoft Word 2002 SP3 and Office 2004 for Mac do not properly handle an uninitialized pointer during parsing of a Word document, which allows remote attackers to execute arbitrary code via a crafted document that triggers memory corruption, aka "Word Uninitialized Pointer Vulnerability." | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2010-2747 | Version: | 5 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows 7 | Product(s): | Microsoft Word 2002 |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:7322 | |||
Oval ID: | oval:org.mitre.oval:def:7322 | ||
Title: | Word Stack Overflow Vulnerability | ||
Description: | Stack-based buffer overflow in Microsoft Word 2002 SP3, 2003 SP3, 2007 SP2, and 2010; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2; Word Viewer; Office Web Apps; and Word Web App allows remote attackers to execute arbitrary code via a crafted Word document, aka "Word Stack Overflow Vulnerability." | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2010-3214 | Version: | 13 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows 7 | Product(s): | Microsoft Word 2002 Microsoft Word 2003 Microsoft Word 2007 Microsoft Word 2010 Microsoft Office Word Viewer Microsoft Office Compatibility Pack |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:7375 | |||
Oval ID: | oval:org.mitre.oval:def:7375 | ||
Title: | Word Boundary Check Vulnerability | ||
Description: | Microsoft Word 2002 SP3 and Office 2004 for Mac do not properly check an unspecified boundary during parsing of a Word document, which allows remote attackers to execute arbitrary code via a crafted document that triggers memory corruption, aka "Word Boundary Check Vulnerability." | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2010-2748 | Version: | 6 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows 7 | Product(s): | Microsoft Word 2002 |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:7529 | |||
Oval ID: | oval:org.mitre.oval:def:7529 | ||
Title: | Word Bookmarks Vulnerability | ||
Description: | Microsoft Word 2002 SP3 and Office 2004 for Mac allow remote attackers to execute arbitrary code via a crafted Word document containing bookmarks that trigger use of an invalid pointer and memory corruption, aka "Word Bookmarks Vulnerability." | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2010-3216 | Version: | 6 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows 7 | Product(s): | Microsoft Word 2002 |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:7582 | |||
Oval ID: | oval:org.mitre.oval:def:7582 | ||
Title: | Word Index Vulnerability | ||
Description: | Array index error in Microsoft Word 2002 SP3 and Office 2004 for Mac allows remote attackers to execute arbitrary code via a crafted Word document that triggers memory corruption, aka "Word Index Vulnerability." | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2010-2750 | Version: | 6 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows 7 | Product(s): | Microsoft Word 2002 |
Definition Synopsis: | |||
CPE : Common Platform Enumeration
Type | Description | Count |
---|---|---|
Application | 2 | |
Application | 1 | |
Application | 1 | |
Application | 1 | |
Application | 5 | |
Application | 1 | |
Application | 1 |
OpenVAS Exploits
Date | Description |
---|---|
2010-10-13 | Name : Microsoft Office Word Remote Code Execution Vulnerabilities (2293194) File : nvt/secpod_ms10-079.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
68584 | Microsoft Office Word Uninitialized Pointer Handling Remote Code Execution A memory corruption flaw exists in Microsoft Word. The program fails to sanitize user-supplied input when handling an uninitialized pointer during parsing of a Word document, resulting in memory corruption. With a specially crafted Word document, a context-dependent attacker can execute arbitrary code. |
68583 | Microsoft Office Word Unspecified Boundary Check Remote Code Execution A memory corruption flaw exists in Microsoft Word. The program fails to check an unspecified boundary while parsing Word documents, resulting in memory corruption. With a specially crafted Word document, a context-dependent attacker can execute arbitrary code. |
68582 | Microsoft Office Word Array Index Value Handling Unspecified Remote Code Exec... A memory corruption flaw exists in Microsoft Word. The program suffers from an array indexing error when handling certain values in a Word document, resulting in memory corruption. With a specially crafted Word document, a context-dependent attacker can execute arbitrary code. |
68581 | Microsoft Office Word File Unspecified Structure Handling Stack Overflow Microsoft Word is prone to an overflow condition. The program fails to properly sanitize user-supplied input resulting in a stack-based buffer overflow. With a specially crafted Word document, a context-dependent attacker can potentially execute arbitrary code. |
68580 | Microsoft Office Word Return Value Handling Unspecified Remote Code Execution A memory corruption flaw exists in Microsoft Word. The program fails to sanitize user-supplied input when handling unspecified return values during parsing of a Word document, resulting in memory corruption. With a specially crafted Word document, a context-dependent attacker can execute arbitrary code. |
68579 | Microsoft Office Word Bookmark Handling Invalid Pointer Remote Code Execution A memory corruption flaw exists in Microsoft Word. The program fails to sanitize user-supplied input when it encounters an invalid pointer when processing bookmarks in a Word document, resulting in memory corruption. With a specially crafted Word document, a context-dependent attacker can execute arbitrary code. |
68578 | Microsoft Office Word Pointer LFO Parsing Double-free Remote Code Execution A memory corruption flaw exists in Microsoft Word. The program suffers from an error due to the use of an invalid pointer while processing certain structures in Word documents, resulting in memory corruption. With a specially crafted Word document with crafted List Format Override records, a context-dependent attacker can execute arbitrary code. |
68577 | Microsoft Office Word Malformed Record Handling Remote Heap Overflow Microsoft Word is prone to an overflow condition. The program fails to properly sanitize user-supplied input resulting in a heap-based buffer overflow. With a specially crafted Word document containing malformed records, a context-dependent attacker can potentially execute arbitrary code. |
68576 | Microsoft Office Word BKF Object Parsing Array Indexing Remote Code Execution A memory corruption flaw exists in Microsoft Word. The program suffers from an an array indexing error when processing BKF objects, resulting in memory corruption. With a specially crafted Word document, a context-dependent attacker can execute arbitrary code. |
68575 | Microsoft Office Word File LVL Structure Parsing Remote Code Execution A memory corruption flaw exists in Microsoft Word. The program fails to sanitize user-supplied input when when processing LVL structures, resulting in memory corruption. With a specially crafted Word document, a context-dependent attacker can execute arbitrary code. |
68574 | Microsoft Office Word File Record Parsing Unspecified Memory Corruption A memory corruption flaw exists in Microsoft Word. The program fails to sanitize user-supplied input when handling a malformed record while parsing a Word document, resulting in memory corruption. With a specially crafted Word document, a context-dependent attacker can execute arbitrary code. |
Information Assurance Vulnerability Management (IAVM)
Date | Description |
---|---|
2010-10-14 | IAVM : 2010-A-0145 - Multiple Vulnerabilities in Microsoft Office Word Severity : Category II - VMSKEY : V0025510 |
Snort® IPS/IDS
Date | Description |
---|---|
2014-01-10 | Microsoft Office Word unchecked index value remote code execution attempt RuleID : 25768 - Revision : 4 - Type : FILE-OFFICE |
2014-01-10 | Microsoft Office Word sprmTDiagLine80 record parsing stack buffer overflow at... RuleID : 19317 - Revision : 12 - Type : FILE-OFFICE |
2014-01-10 | Microsoft Office Word malformed index code execution attempt RuleID : 19153 - Revision : 14 - Type : FILE-OFFICE |
2014-01-10 | Microsoft Office Word XP PLFLSInTableStream heap overflow attempt RuleID : 17756 - Revision : 16 - Type : FILE-OFFICE |
2014-01-10 | Microsoft Office Word unchecked index value remote code execution attempt RuleID : 17755 - Revision : 14 - Type : FILE-OFFICE |
2014-01-10 | Microsoft Office Word bookmark bound check remote code execution attempt RuleID : 17754 - Revision : 13 - Type : FILE-OFFICE |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2010-10-20 | Name : An application installed on the remote Mac OS X host is affected by multiple ... File : macosx_ms_office_oct2010.nasl - Type : ACT_GATHER_INFO |
2010-10-13 | Name : Arbitrary code can be executed on the remote host through Microsoft Word. File : smb_nt_ms10-079.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 11:46:44 |
|
2014-01-19 21:30:32 |
|
2013-11-11 12:41:19 |
|
2013-05-11 00:49:43 |
|