Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Summary | |
|---|---|
| Title | Microsoft Updates for Multiple Vulnerabilities |
| Informations | |||
|---|---|---|---|
| Name | TA10-313A | First vendor Publication | 2010-11-09 |
| Vendor | US-CERT | Last vendor Modification | 2010-11-09 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 9.3 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| There are multiple vulnerabilities in Microsoft Office, and Microsoft Forefront United Access Gateway. Microsoft has released updates to address these vulnerabilities. I. Description The Microsoft Security Bulletin Summary for November 2010 describes multiple vulnerabilities in Microsoft Office, and Microsoft Forefront United Access Gateway. Microsoft has released updates to address the vulnerabilities. II. Impact A remote, unauthenticated attacker could execute arbitrary code or gain unauthorized access to your files or system. III. Solution Apply updates Microsoft has provided updates for these vulnerabilities in the Microsoft Security Bulletin Summary for November 2010. That bulletin describes any known issues related to the updates. |
Original Source
| Url : http://www.us-cert.gov/cas/techalerts/TA10-313A.html |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 30 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
| 30 % | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25) |
| 10 % | CWE-787 | Out-of-bounds Write (CWE/SANS Top 25) |
| 10 % | CWE-189 | Numeric Errors (CWE/SANS Top 25) |
| 10 % | CWE-120 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE/SANS Top 25) |
| 10 % | CWE-20 | Improper Input Validation |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:11439 | |||
| Oval ID: | oval:org.mitre.oval:def:11439 | ||
| Title: | Office Art Drawing Records Vulnerability | ||
| Description: | Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via an Office document containing an Office Art Drawing record with crafted msofbtSp records and unspecified flags, which triggers memory corruption, aka "Office Art Drawing Records Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2010-3334 | Version: | 8 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows 7 | Product(s): | Microsoft Office XP Microsoft Office 2003 Microsoft Office 2007 Microsoft Office 2010 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:11739 | |||
| Oval ID: | oval:org.mitre.oval:def:11739 | ||
| Title: | Drawing Exception Handling Vulnerability | ||
| Description: | Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via a crafted Office document that triggers memory corruption, aka "Drawing Exception Handling Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2010-3335 | Version: | 8 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows 7 | Product(s): | Microsoft Office XP Microsoft Office 2003 Microsoft Office 2007 Microsoft Office 2010 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:11929 | |||
| Oval ID: | oval:org.mitre.oval:def:11929 | ||
| Title: | Insecure Library Loading Vulnerability | ||
| Description: | Untrusted search path vulnerability in Microsoft Office 2007 SP2 and 2010 allows local users to gain privileges via a Trojan horse DLL in the current working directory, aka "Insecure Library Loading Vulnerability." NOTE: this might overlap CVE-2010-3141 and CVE-2010-3142. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2010-3337 | Version: | 8 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows 7 | Product(s): | Microsoft Office 2007 Microsoft Office 2010 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:11931 | |||
| Oval ID: | oval:org.mitre.oval:def:11931 | ||
| Title: | RTF Stack Buffer Overflow Vulnerability | ||
| Description: | Stack-based buffer overflow in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via crafted RTF data, aka "RTF Stack Buffer Overflow Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2010-3333 | Version: | 8 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows 7 | Product(s): | Microsoft Office XP Microsoft Office 2003 Microsoft Office 2007 Microsoft Office 2010 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:11947 | |||
| Oval ID: | oval:org.mitre.oval:def:11947 | ||
| Title: | MSO Large SPID Read AV Vulnerability | ||
| Description: | Microsoft Office XP SP3, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via a crafted Office document that triggers memory corruption, aka "MSO Large SPID Read AV Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2010-3336 | Version: | 3 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows 7 | Product(s): | Microsoft Office XP |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:12058 | |||
| Oval ID: | oval:org.mitre.oval:def:12058 | ||
| Title: | XSS Issue on UAG Mobile Portal Website in Forefront Unified Access Gateway Vulnerability | ||
| Description: | Cross-site scripting (XSS) vulnerability in the mobile portal in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, 2010 Update 1, and 2010 Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "XSS Issue on UAG Mobile Portal Website in Forefront Unified Access Gateway Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2010-2734 | Version: | 3 |
| Platform(s): | Microsoft Windows Server 2008 | Product(s): | Forefront Unified Access Gateway 2010 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:12122 | |||
| Oval ID: | oval:org.mitre.oval:def:12122 | ||
| Title: | PowerPoint Integer Underflow Causes Heap Corruption Vulnerability | ||
| Description: | Integer underflow in Microsoft PowerPoint 2002 SP3 and 2003 SP3, PowerPoint Viewer SP2, and Office 2004 for Mac allows remote attackers to execute arbitrary code via a crafted PowerPoint document, aka "PowerPoint Integer Underflow Causes Heap Corruption Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2010-2573 | Version: | 5 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows 7 | Product(s): | Microsoft Office PowerPoint 2002 Microsoft Office PowerPoint 2003 Microsoft PowerPoint Viewer 2007 Service Pack 2 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:12127 | |||
| Oval ID: | oval:org.mitre.oval:def:12127 | ||
| Title: | UAG XSS Allows EOP Vulnerability | ||
| Description: | Cross-site scripting (XSS) vulnerability in the Web Monitor in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, 2010 Update 1, and 2010 Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "UAG XSS Allows EOP Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2010-2733 | Version: | 3 |
| Platform(s): | Microsoft Windows Server 2008 | Product(s): | Forefront Unified Access Gateway 2010 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:12195 | |||
| Oval ID: | oval:org.mitre.oval:def:12195 | ||
| Title: | PowerPoint Parsing Buffer Overflow Vulnerability | ||
| Description: | Buffer overflow in Microsoft PowerPoint 2002 SP3 and 2003 SP3 allows remote attackers to execute arbitrary code via a crafted PowerPoint 95 document, aka "PowerPoint Parsing Buffer Overflow Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2010-2572 | Version: | 5 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows 7 | Product(s): | Microsoft Office PowerPoint 2002 Microsoft Office PowerPoint 2003 |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:12218 | |||
| Oval ID: | oval:org.mitre.oval:def:12218 | ||
| Title: | XSS in Signurl.asp Vulnerability | ||
| Description: | Cross-site scripting (XSS) vulnerability in Signurl.asp in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, 2010 Update 1, and 2010 Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "XSS in Signurl.asp Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2010-3936 | Version: | 3 |
| Platform(s): | Microsoft Windows Server 2008 | Product(s): | Forefront Unified Access Gateway 2010 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:12257 | |||
| Oval ID: | oval:org.mitre.oval:def:12257 | ||
| Title: | UAG Redirection Spoofing Vulnerability | ||
| Description: | Open redirect vulnerability in the web interface in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, 2010 Update 1, and 2010 Update 2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, aka "UAG Redirection Spoofing Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2010-2732 | Version: | 3 |
| Platform(s): | Microsoft Windows Server 2008 | Product(s): | Forefront Unified Access Gateway 2010 |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
SAINT Exploits
| Description | Link |
|---|---|
| Microsoft Excel Drawing Exception Handling vulnerability | More info here |
| Microsoft Office RTF pFragments Property Stack Buffer Overflow | More info here |
ExploitDB Exploits
| id | Description |
|---|---|
| 2011-07-03 | MS Office 2010 RTF Header Stack Overflow Vulnerability Exploit |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2011-08-11 | Name : Microsoft Windows Insecure Library Loading Vulnerability (2269637) File : nvt/gb_ms_insecure_lib_loading_vuln.nasl |
| 2010-11-10 | Name : Microsoft Office Remote Code Execution Vulnerabilites (2423930) File : nvt/secpod_ms10-087.nasl |
| 2010-11-10 | Name : Microsoft Office PowerPoint Remote Code Execution Vulnerabilities (2293386) File : nvt/secpod_ms10-088.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 69095 | Microsoft Forefront Unified Access Gateway (UAG) Signurl.asp XSS Forefront Unified Access Gateway contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because Unspecified input passed to Signurl.asp is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. It can allow an attacker to issue commands to the UAG server in the context of the targeted user. |
| 69094 | Microsoft Forefront Unified Access Gateway (UAG) Mobile Portal Website Unspec... Microsoft Forefront Unified Access Gateway contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because unspecified input passed to the UAG Mobile Portal website is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.It can allow an attacker to issue commands to the UAG server in the context of the targeted user. |
| 69093 | Microsoft Forefront Unified Access Gateway (UAG) EOP Unspecified XSS Microsoft Forefront Unified Access Gateway contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because unspecified input is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. It can allow an attacker to issue commands to the UAG server in the context of the targeted user |
| 69092 | Microsoft Forefront Unified Access Gateway (UAG) Redirection Spoofing Weakness Microsoft Forefront Unified Access Gateway contains a flaw that allows spoofing or redirecting of traffic. This allows remote attackers to redirect targets to arbitrary sites, where the attacker may potentially acquire sensitive information, such as the user's credentials. |
| 69091 | Microsoft Office PowerPoint File Animation Node Parsing Underflow Heap Corrup... Microsoft Office and PowerPoint contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to an integer underflow error when parsing a certain animation node and can be exploited to cause a heap-based buffer overflow via a specially crafted PowerPoint file. It may allow execution of arbitrary code. |
| 69090 | Microsoft Office PowerPoint 95 File Parsing Overflow Microsoft Office and Powerpoint contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to a logic error in PP7X32.DLL when parsing certain records can be exploited to cause a heap-based buffer overflow via a specially crafted PowerPoint 95 file. It may allow execution of arbitrary code. |
| 69089 | Microsoft Office Insecure Library Loading Remote Code Execution Microsoft Office contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the way that Microsoft Office handles the loading of DLL files. It may allow execution of arbitrary code. |
| 69088 | Microsoft Office MSO Large SPID Read AV Remote Code Execution Microsoft Office contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to an error handling a large SPID can be exploited to corrupt memory via a specially crafted file. It may allow execution of arbitrary code. |
| 69087 | Microsoft Office Drawing Exception Handling Remote Code Execution Microsoft Office contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to a use-after-free error when handling parsing errors during parsing of Office Art records can be exploited via a specially crafted file. It may allow execution of arbitrary code. |
| 69086 | Microsoft Office Art Drawing Record Parsing Remote Code Execution Microsoft Office contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to Insufficient validation when parsing an Office Art Drawing record, which contains "msofbtSp" records that specify certain flags can be exploited to corrupt memory via a specially crafted Office file. It may allow execution of arbitrary code. |
| 69085 | Microsoft Office RTF Parsing Stack Overflow Microsoft Office contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to a boundary error when parsing a certain control word in RTF (Rich Text Format) formatted content can be exploited to cause a stack-based buffer overflow via a specially crafted file. It may allow execution of arbitrary code. |
Information Assurance Vulnerability Management (IAVM)
| Date | Description |
|---|---|
| 2010-11-10 | IAVM : 2010-A-0159 - Multiple Vulnerabilities in Microsoft Forefront Unified Access Gateway (UAG) Severity : Category II - VMSKEY : V0025710 |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2018-02-27 | Microsoft Office embedded Office Art drawings execution attempt RuleID : 45557 - Revision : 1 - Type : FILE-OFFICE |
| 2018-02-27 | Microsoft Office embedded Office Art drawings execution attempt RuleID : 45556 - Revision : 1 - Type : FILE-OFFICE |
| 2017-08-23 | Microsoft Office RTF parsing remote code execution attempt RuleID : 43679 - Revision : 1 - Type : FILE-OFFICE |
| 2017-08-23 | Microsoft Office RTF parsing remote code execution attempt RuleID : 43678 - Revision : 1 - Type : FILE-OFFICE |
| 2014-01-18 | Win.Trojan.Egobot variant outbound connection RuleID : 28989 - Revision : 4 - Type : MALWARE-CNC |
| 2014-01-10 | Microsoft Office RTF malformed pfragments field RuleID : 25393 - Revision : 4 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office PowerPoint integer underflow heap corruption attempt RuleID : 25311 - Revision : 5 - Type : FILE-OFFICE |
| 2014-01-10 | DNS request for known malware domain losang.dynamicdns.co.uk RuleID : 25069 - Revision : 2 - Type : BLACKLIST |
| 2014-01-10 | Win.Trojan.Riler inbound connection RuleID : 25068 - Revision : 2 - Type : MALWARE-CNC |
| 2014-01-10 | Win.Trojan.Riler variant outbound connection RuleID : 25067 - Revision : 3 - Type : MALWARE-CNC |
| 2014-01-10 | Microsoft Office RTF malformed pfragments field RuleID : 22102 - Revision : 8 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office RTF malformed pfragments field RuleID : 22101 - Revision : 7 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office embedded Office Art drawings execution attempt RuleID : 22037 - Revision : 3 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office embedded Office Art drawings execution attempt RuleID : 22036 - Revision : 3 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office embedded Office Art drawings execution attempt RuleID : 22035 - Revision : 3 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office Excel malformed MsoDrawingObject record attempt RuleID : 19260 - Revision : 16 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office PowerPoint converter bad indirection remote code execution a... RuleID : 18948 - Revision : 17 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office RTF malformed second pfragments field RuleID : 18706 - Revision : 15 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office RTF malformed second pfragments field RuleID : 18705 - Revision : 11 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office RTF malformed second pfragments field RuleID : 18704 - Revision : 13 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office RTF malformed pfragments field RuleID : 18703 - Revision : 12 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office RTF malformed pfragments field RuleID : 18702 - Revision : 14 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office RTF malformed pfragments field RuleID : 18680 - Revision : 19 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office RTF parsing remote code execution attempt RuleID : 18310 - Revision : 12 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Forefront UAG URL XSS alternate attempt RuleID : 18076 - Revision : 11 - Type : OS-WINDOWS |
| 2014-01-10 | Microsoft Windows Forefront UAG URL XSS attempt RuleID : 18074 - Revision : 8 - Type : OS-WINDOWS |
| 2014-01-10 | Microsoft Forefront UAG arbitrary embedded scripting attempt RuleID : 18073 - Revision : 10 - Type : OS-WINDOWS |
| 2014-01-10 | Microsoft Forefront UAG external redirect attempt RuleID : 18072 - Revision : 9 - Type : OS-WINDOWS |
| 2014-01-10 | Microsoft Office pptimpconv.dll dll-load exploit attempt RuleID : 18071 - Revision : 13 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office pptimpconv.dll dll-load exploit attempt RuleID : 18070 - Revision : 14 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office Art drawing invalid shape identifier attempt RuleID : 18069 - Revision : 17 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office Excel malformed MsoDrawingObject record attempt RuleID : 18068 - Revision : 15 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office RTF parsing remote code execution attempt RuleID : 18067 - Revision : 14 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office PowerPoint integer underflow heap corruption attempt RuleID : 18066 - Revision : 17 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office PowerPoint converter bad indirection remote code execution a... RuleID : 18065 - Revision : 15 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office embedded Office Art drawings execution attempt RuleID : 18063 - Revision : 11 - Type : FILE-OFFICE |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2010-11-09 | Name : An application installed on the remote Mac OS X host is affected by multiple ... File : macosx_ms_office_nov2010.nasl - Type : ACT_GATHER_INFO |
| 2010-11-09 | Name : Arbitrary code can be executed on the remote host through Microsoft Office. File : smb_nt_ms10-087.nasl - Type : ACT_GATHER_INFO |
| 2010-11-09 | Name : Arbitrary code can be executed on the remote host through Microsoft PowerPoint. File : smb_nt_ms10-088.nasl - Type : ACT_GATHER_INFO |
| 2010-11-09 | Name : An application on the remote host has multiple vulnerabilities File : smb_nt_ms10-089.nasl - Type : ACT_GATHER_INFO |
