Executive Summary
Summary | |
---|---|
Title | Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (2489293) |
Informations | |||
---|---|---|---|
Name | MS11-023 | First vendor Publication | 2011-04-12 |
Vendor | Microsoft | Last vendor Modification | 2011-04-12 |
Severity (Vendor) | Important | Revision | 1.0 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
---|---|---|---|
Cvss Base Score | 9.3 | Attack Range | Network |
Cvss Impact Score | 10 | Attack Complexity | Medium |
Cvss Expoit Score | 8.6 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Revision Note: V1.0 (April 12, 2011): Bulletin published.Summary: This security update resolves one publicly disclosed vulnerability and one privately reported vulnerability in Microsoft Office. The vulnerabilities could allow remote code execution if a user opens a specially crafted Office file or if a user opens a legitimate Office file that is located in the same network directory as a specially crafted library file. An attacker who successfully exploited either of these vulnerabilities could gain the same user rights as the logged on user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. |
Original Source
Url : http://www.microsoft.com/technet/security/bulletin/MS11-023.mspx |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-399 | Resource Management Errors |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:12339 | |||
Oval ID: | oval:org.mitre.oval:def:12339 | ||
Title: | Microsoft Office Graphic Object Dereferencing Vulnerability | ||
Description: | Use-after-free vulnerability in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via malformed shape data in the Office drawing file format, aka "Microsoft Office Graphic Object Dereferencing Vulnerability." | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2011-0977 | Version: | 6 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows 7 | Product(s): | Microsoft Office XP Microsoft Office 2003 Microsoft Office 2007 |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:12655 | |||
Oval ID: | oval:org.mitre.oval:def:12655 | ||
Title: | Office Component Insecure Library Loading Vulnerability | ||
Description: | Untrusted search path vulnerability in Microsoft Office XP SP3, Office 2003 SP3, and Office 2007 SP2 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .docx file, aka "Office Component Insecure Library Loading Vulnerability." | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2011-0107 | Version: | 5 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows 7 | Product(s): | Microsoft Office XP Microsoft Office 2003 Microsoft Office 2007 |
Definition Synopsis: | |||
|
CPE : Common Platform Enumeration
Type | Description | Count |
---|---|---|
Application | 1 | |
Application | 3 |
OpenVAS Exploits
Date | Description |
---|---|
2011-04-13 | Name : Microsoft Office Remote Code Execution Vulnerabilites (2489293) File : nvt/secpod_ms11-023.nasl |
2011-02-23 | Name : Microsoft Excel 2007 Office Drawing Layer Remote Code Execution Vulnerability File : nvt/gb_ms_office_excel_drawing_layer_code_exec_vuln.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
71768 | Microsoft Office Graphic Object Parsing Remote Code Execution Microsoft Office and Open XML File Format Converter for Mac contain a flaw related to the office drawing file format. The issue is triggered when an error occurs during parsing of shape data and freeing used elements without removing references to them. This may allow a context-dependent attacker using a crafted shape data in the Office drawing file format to execute arbitrary code. |
71767 | Microsoft Office Path Subversion Arbitrary DLL Injection Code Execution Microsoft Office is prone to a flaw in the way it loads dynamic-link libraries (DLL). The program uses a fixed path to look for specific files or libraries. This path includes directories that may not be trusted or under user control. By placing a custom version of the file or library in the path, the program will load it before the legitimate version. This allows an attacker to inject custom code that will be run with the privilege of the program or user executing the program. This can be done by tricking a user into opening a .docx file from the local file system or a USB drive in some cases. This attack can be leveraged remotely in some cases by placing the malicious file or library on a network share or extracted archive downloaded from a remote source. |
Information Assurance Vulnerability Management (IAVM)
Date | Description |
---|---|
2011-04-14 | IAVM : 2011-A-0045 - Multiple Vulnerabilities in Microsoft Office Severity : Category II - VMSKEY : V0026527 |
Snort® IPS/IDS
Date | Description |
---|---|
2016-03-14 | Microsoft Office Word request for rpawinet.dll over SMB attempt RuleID : 37319 - Revision : 5 - Type : FILE-OFFICE |
2016-03-14 | Microsoft Office Word rpawinet.dll dll-load exploit attempt RuleID : 37318 - Revision : 5 - Type : FILE-OFFICE |
2014-03-15 | Microsoft Internet Explorer SelectAll dangling pointer use after free attempt RuleID : 29797 - Revision : 3 - Type : BROWSER-IE |
2014-03-15 | Microsoft Internet Explorer SelectAll dangling pointer use after free attempt RuleID : 29796 - Revision : 3 - Type : BROWSER-IE |
2014-01-10 | Microsoft Office Excel drawing layer use after free attempt RuleID : 24242 - Revision : 7 - Type : FILE-OFFICE |
2014-01-10 | Microsoft Office Excel drawing layer use after free attempt RuleID : 24241 - Revision : 7 - Type : FILE-OFFICE |
2014-01-10 | Microsoft Office Excel drawing layer use after free attempt RuleID : 24240 - Revision : 7 - Type : FILE-OFFICE |
2014-01-10 | Microsoft Internet Explorer SelectAll dangling pointer use after free attempt RuleID : 22038 - Revision : 8 - Type : BROWSER-IE |
2014-01-10 | Microsoft Internet Explorer SelectAll dangling pointer use after free attempt RuleID : 21791 - Revision : 7 - Type : BROWSER-IE |
2014-01-10 | Microsoft Internet Explorer SelectAll dangling pointer use after free attempt RuleID : 21790 - Revision : 7 - Type : BROWSER-IE |
2014-01-10 | Microsoft product fputlsat.dll dll-load exploit attempt RuleID : 21310 - Revision : 7 - Type : OS-WINDOWS |
2014-01-10 | Microsoft product request for fputlsat.dll over SMB attempt RuleID : 21309 - Revision : 7 - Type : OS-WINDOWS |
2015-05-28 | Microsoft Word .dll dll-load exploit attempt RuleID : 18650 - Revision : 4 - Type : NETBIOS |
2015-05-28 | Microsoft Word .dll dll-load exploit attempt RuleID : 18647 - Revision : 3 - Type : WEB-CLIENT |
2014-01-10 | Microsoft Office Excel drawing layer use after free attempt RuleID : 18638 - Revision : 20 - Type : FILE-OFFICE |
2014-01-10 | Microsoft product .dll dll-load exploit attempt RuleID : 18495 - Revision : 21 - Type : OS-WINDOWS |
2014-01-10 | Microsoft product .dll dll-load exploit attempt RuleID : 18494 - Revision : 25 - Type : OS-WINDOWS |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2011-04-13 | Name : An application installed on the remote Mac OS X host is affected by multiple ... File : macosx_ms_office_apr2011.nasl - Type : ACT_GATHER_INFO |
2011-04-13 | Name : Arbitrary code can be executed on the remote host through Microsoft Office. File : smb_nt_ms11-023.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2015-05-28 21:26:37 |
|
2014-03-15 21:20:36 |
|
2014-02-17 11:46:55 |
|
2014-01-19 21:30:39 |
|
2013-11-11 12:41:22 |
|