ID CVE-2010-1263
Summary Windows Shell and WordPad in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7; Microsoft Office XP SP3; Office 2003 SP3; and Office System 2007 SP1 and SP2 do not properly validate COM objects during instantiation, which allows remote attackers to execute arbitrary code via a crafted file, aka "COM Validation Vulnerability."
References
Vulnerable Configurations
  • Microsoft Office 2003 Service Pack 3
    cpe:2.3:a:microsoft:office:2003:sp3
  • Microsoft Office 2007 Service Pack 1
    cpe:2.3:a:microsoft:office:2007:sp1
  • Microsoft Office 2007 Service Pack 2
    cpe:2.3:a:microsoft:office:2007:sp2
  • Microsoft Office XP Service Pack 3
    cpe:2.3:a:microsoft:office:xp:sp3
CVSS
Base: 9.3 (as of 09-06-2010 - 13:29)
Impact:
Exploitability:
CWE CWE-94
CAPEC
  • Leverage Executable Code in Non-Executable Files
    An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high. The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/) http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process. The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality. The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
  • Manipulating User-Controlled Variables
    This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An attacker can override environment variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the attacker can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
msbulletin via4
  • bulletin_id MS10-036
    bulletin_url
    date 2010-06-08T00:00:00
    impact Remote Code Execution
    knowledgebase_id 983235
    knowledgebase_url
    severity Important
    title Vulnerability in COM Validation in Microsoft Office Could Allow Remote Code Execution
  • bulletin_id MS10-083
    bulletin_url
    date 2010-10-12T00:00:00
    impact Remote Code Execution
    knowledgebase_id 2405882
    knowledgebase_url
    severity Important
    title Vulnerability in COM Validation in Windows Shell and WordPad Could Allow Remote Code Execution
nessus via4
  • NASL family Windows : Microsoft Bulletins
    NASL id SMB_NT_MS10-083.NASL
    description The remote windows host contains a version of the Windows Shell or the WordPad text editor that contains a vulnerability in the way it handles shortcut files. An attacker, exploiting this flaw, can execute arbitrary commands on the remote host subject to the privileges of the user opening the file.
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 49960
    published 2010-10-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=49960
    title MS10-083: Vulnerability in COM Validation in Windows Shell and WordPad Could Allow Remote Code Execution (2405882)
  • NASL family Windows
    NASL id WIN_SERVER_2008_NTLM_PCI.NASL
    description According to the version number obtained by NTLM the remote host has Windows Server 2008 installed. The host may be vulnerable to a number of vulnerabilities including remote unauthenticated code execution.
    last seen 2019-02-21
    modified 2018-09-17
    plugin id 108811
    published 2018-04-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=108811
    title Windows Server 2008 Critical RCE Vulnerabilities (uncredentialed) (PCI/DSS)
  • NASL family Windows : Microsoft Bulletins
    NASL id SMB_NT_MS10-036.NASL
    description The remote host contains a vulnerable version of Microsoft Office 2003 or 2007. Opening a specially crafted Office file can result in arbitrary code execution. A remote attacker can exploit this by tricking a user into opening a specially crafted Office file.
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 46843
    published 2010-06-09
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=46843
    title MS10-036: Vulnerability in COM Validation in Microsoft Office Could Allow Remote Code Execution (983235)
oval via4
accepted 2014-08-18T04:06:26.100-04:00
class vulnerability
contributors
  • name Josh Turpin
    organization Symantec Corporation
  • name Josh Turpin
    organization Symantec Corporation
  • name Josh Turpin
    organization Symantec Corporation
  • name Dragos Prisaca
    organization Symantec Corporation
  • name Shane Shaffer
    organization G2, Inc.
  • name Shane Shaffer
    organization G2, Inc.
  • name Shane Shaffer
    organization G2, Inc.
  • name Shane Shaffer
    organization G2, Inc.
  • name Josh Turpin
    organization Symantec Corporation
  • name Shane Shaffer
    organization G2, Inc.
  • name Maria Kedovskaya
    organization ALTX-SOFT
  • name Maria Mikhno
    organization ALTX-SOFT
  • name Maria Mikhno
    organization ALTX-SOFT
  • name Maria Mikhno
    organization ALTX-SOFT
  • name Evgeniy Pavlov
    organization ALTX-SOFT
definition_extensions
  • comment Microsoft Office XP is installed
    oval oval:org.mitre.oval:def:663
  • comment Microsoft Office 2007 is installed
    oval oval:org.mitre.oval:def:1211
  • comment Microsoft Office 2003 is installed
    oval oval:org.mitre.oval:def:233
  • comment Microsoft Word 2007 is installed
    oval oval:org.mitre.oval:def:2074
  • comment Microsoft Word 2003 is installed
    oval oval:org.mitre.oval:def:475
  • comment Microsoft Office Visio 2007 is installed
    oval oval:org.mitre.oval:def:5261
  • comment Microsoft Office Visio 2003 is installed
    oval oval:org.mitre.oval:def:1450
  • comment Microsoft PowerPoint 2007 is installed
    oval oval:org.mitre.oval:def:5937
  • comment Microsoft Publisher 2007 is installed
    oval oval:org.mitre.oval:def:2127
  • comment Microsoft Publisher 2003 is installed
    oval oval:org.mitre.oval:def:239
  • comment Microsoft PowerPoint 2003 is installed
    oval oval:org.mitre.oval:def:666
  • comment Microsoft Excel 2003 is installed
    oval oval:org.mitre.oval:def:764
  • comment Microsoft Excel 2007 is installed
    oval oval:org.mitre.oval:def:1745
  • comment Microsoft Windows XP (32-bit) is installed
    oval oval:org.mitre.oval:def:1353
  • comment Microsoft Windows XP x64 is installed
    oval oval:org.mitre.oval:def:15247
  • comment Microsoft Windows Server 2003 (x64) is installed
    oval oval:org.mitre.oval:def:730
  • comment Microsoft Windows Server 2003 (32-bit) is installed
    oval oval:org.mitre.oval:def:1870
  • comment Microsoft Windows Server 2003 (ia64) Gold is installed
    oval oval:org.mitre.oval:def:396
  • comment Microsoft Windows Vista (32-bit) is installed
    oval oval:org.mitre.oval:def:1282
  • comment Microsoft Windows Vista x64 Edition is installed
    oval oval:org.mitre.oval:def:2041
  • comment Microsoft Windows Server 2008 (32-bit) is installed
    oval oval:org.mitre.oval:def:4870
  • comment Microsoft Windows Server 2008 (64-bit) is installed
    oval oval:org.mitre.oval:def:5356
  • comment Microsoft Windows Server 2008 (ia-64) is installed
    oval oval:org.mitre.oval:def:5667
  • comment Microsoft Windows Vista (32-bit) is installed
    oval oval:org.mitre.oval:def:1282
  • comment Microsoft Windows Server 2008 (32-bit) is installed
    oval oval:org.mitre.oval:def:4870
  • comment Microsoft Windows Vista x64 Edition is installed
    oval oval:org.mitre.oval:def:2041
  • comment Microsoft Windows Server 2008 (64-bit) is installed
    oval oval:org.mitre.oval:def:5356
  • comment Microsoft Windows Server 2008 (ia-64) is installed
    oval oval:org.mitre.oval:def:5667
  • comment Microsoft Windows 7 (32-bit) is installed
    oval oval:org.mitre.oval:def:6165
  • comment Microsoft Windows 7 x64 Edition is installed
    oval oval:org.mitre.oval:def:5950
  • comment Microsoft Windows Server 2008 R2 x64 Edition is installed
    oval oval:org.mitre.oval:def:6438
  • comment Microsoft Windows Server 2008 R2 Itanium-Based Edition is installed
    oval oval:org.mitre.oval:def:5954
description Windows Shell and WordPad in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7; Microsoft Office XP SP3; Office 2003 SP3; and Office System 2007 SP1 and SP2 do not properly validate COM objects during instantiation, which allows remote attackers to execute arbitrary code via a crafted file, aka "COM Validation Vulnerability."
family windows
id oval:org.mitre.oval:def:7286
status accepted
submitted 2010-03-09T13:00:00
title COM Validation Vulnerability
version 101
refmap via4
bid 40574
cert
  • TA10-159B
  • TA10-285A
ms
  • MS10-036
  • MS10-083
sectrack 1024555
Last major update 04-10-2011 - 22:43
Published 08-06-2010 - 16:30
Last modified 12-10-2018 - 17:57
Back to Top