Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Summary | |
|---|---|
| Title | Vulnerabilities in Microsoft PowerPoint Could Allow Remote Code Execution (2293386) |
| Informations | |||
|---|---|---|---|
| Name | MS10-088 | First vendor Publication | 2010-11-09 |
| Vendor | Microsoft | Last vendor Modification | 2011-04-12 |
| Severity (Vendor) | Important | Revision | 1.3 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 9.3 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Revision Note: V1.3 (April 12, 2011): Announced that the security update for Microsoft Office 2004 for Mac (KB2505924) offered in MS11-021, MS11-022, and MS11-023 also addresses the vulnerabilities described in this security bulletin.Summary: This security update resolves two privately reported vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted PowerPoint file. An attacker who successfully exploited any of these vulnerabilities could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. |
Original Source
| Url : http://www.microsoft.com/technet/security/bulletin/MS10-088.mspx |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 50 % | CWE-189 | Numeric Errors (CWE/SANS Top 25) |
| 50 % | CWE-120 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE/SANS Top 25) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:12122 | |||
| Oval ID: | oval:org.mitre.oval:def:12122 | ||
| Title: | PowerPoint Integer Underflow Causes Heap Corruption Vulnerability | ||
| Description: | Integer underflow in Microsoft PowerPoint 2002 SP3 and 2003 SP3, PowerPoint Viewer SP2, and Office 2004 for Mac allows remote attackers to execute arbitrary code via a crafted PowerPoint document, aka "PowerPoint Integer Underflow Causes Heap Corruption Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2010-2573 | Version: | 5 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows 7 | Product(s): | Microsoft Office PowerPoint 2002 Microsoft Office PowerPoint 2003 Microsoft PowerPoint Viewer 2007 Service Pack 2 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:12195 | |||
| Oval ID: | oval:org.mitre.oval:def:12195 | ||
| Title: | PowerPoint Parsing Buffer Overflow Vulnerability | ||
| Description: | Buffer overflow in Microsoft PowerPoint 2002 SP3 and 2003 SP3 allows remote attackers to execute arbitrary code via a crafted PowerPoint 95 document, aka "PowerPoint Parsing Buffer Overflow Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2010-2572 | Version: | 5 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows 7 | Product(s): | Microsoft Office PowerPoint 2002 Microsoft Office PowerPoint 2003 |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 1 | |
| Application | 2 | |
| Application | 1 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2010-11-10 | Name : Microsoft Office PowerPoint Remote Code Execution Vulnerabilities (2293386) File : nvt/secpod_ms10-088.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 69091 | Microsoft Office PowerPoint File Animation Node Parsing Underflow Heap Corrup... Microsoft Office and PowerPoint contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to an integer underflow error when parsing a certain animation node and can be exploited to cause a heap-based buffer overflow via a specially crafted PowerPoint file. It may allow execution of arbitrary code. |
| 69090 | Microsoft Office PowerPoint 95 File Parsing Overflow Microsoft Office and Powerpoint contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to a logic error in PP7X32.DLL when parsing certain records can be exploited to cause a heap-based buffer overflow via a specially crafted PowerPoint 95 file. It may allow execution of arbitrary code. |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2014-01-10 | Microsoft Office PowerPoint integer underflow heap corruption attempt RuleID : 25311 - Revision : 5 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office PowerPoint converter bad indirection remote code execution a... RuleID : 18948 - Revision : 17 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office PowerPoint integer underflow heap corruption attempt RuleID : 18066 - Revision : 17 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office PowerPoint converter bad indirection remote code execution a... RuleID : 18065 - Revision : 15 - Type : FILE-OFFICE |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2010-11-09 | Name : Arbitrary code can be executed on the remote host through Microsoft Office. File : smb_nt_ms10-087.nasl - Type : ACT_GATHER_INFO |
| 2010-11-09 | Name : Arbitrary code can be executed on the remote host through Microsoft PowerPoint. File : smb_nt_ms10-088.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:46:46 |
|
| 2014-01-19 21:30:33 |
|
