Vulnerabilities > CVE-2010-1263 - Code Injection vulnerability in Microsoft Office 2003/2007/Xp
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
COMPLETE Integrity impact
COMPLETE Availability impact
COMPLETE Summary
Windows Shell and WordPad in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7; Microsoft Office XP SP3; Office 2003 SP3; and Office System 2007 SP1 and SP2 do not properly validate COM objects during instantiation, which allows remote attackers to execute arbitrary code via a crafted file, aka "COM Validation Vulnerability."
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 4 |
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Leverage Executable Code in Non-Executable Files An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high. The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/) http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process. The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality. The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
- Manipulating User-Controlled Variables This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An attacker can override environment variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the attacker can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.
Msbulletin
bulletin_id MS10-036 bulletin_url date 2010-06-08T00:00:00 impact Remote Code Execution knowledgebase_id 983235 knowledgebase_url severity Important title Vulnerability in COM Validation in Microsoft Office Could Allow Remote Code Execution bulletin_id MS10-083 bulletin_url date 2010-10-12T00:00:00 impact Remote Code Execution knowledgebase_id 2405882 knowledgebase_url severity Important title Vulnerability in COM Validation in Windows Shell and WordPad Could Allow Remote Code Execution
Nessus
NASL family Windows : Microsoft Bulletins NASL id SMB_NT_MS10-083.NASL description The remote windows host contains a version of the Windows Shell or the WordPad text editor that contains a vulnerability in the way it handles shortcut files. An attacker, exploiting this flaw, can execute arbitrary commands on the remote host subject to the privileges of the user opening the file. last seen 2020-06-01 modified 2020-06-02 plugin id 49960 published 2010-10-13 reporter This script is Copyright (C) 2010-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/49960 title MS10-083: Vulnerability in COM Validation in Windows Shell and WordPad Could Allow Remote Code Execution (2405882) code # # (C) Tenable Network Security, Inc. # include('compat.inc'); if (description) { script_id(49960); script_version("1.24"); script_cvs_date("Date: 2018/11/15 20:50:30"); script_cve_id("CVE-2010-1263"); script_bugtraq_id(40574); script_xref(name:"MSFT", value:"MS10-083"); script_xref(name:"IAVA", value:"2010-A-0134"); script_xref(name:"MSKB", value:"979687"); script_name(english:"MS10-083: Vulnerability in COM Validation in Windows Shell and WordPad Could Allow Remote Code Execution (2405882)"); script_summary(english:"Checks version of Msshq.dll / Structuredquery.dll and Ole32.dll"); script_set_attribute(attribute:"synopsis", value: "The remote windows host is affected by a remote code execution vulnerability."); script_set_attribute(attribute:"description", value: "The remote windows host contains a version of the Windows Shell or the WordPad text editor that contains a vulnerability in the way it handles shortcut files. An attacker, exploiting this flaw, can execute arbitrary commands on the remote host subject to the privileges of the user opening the file."); script_set_attribute(attribute:"see_also", value:"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2010/ms10-083"); script_set_attribute(attribute:"solution", value: "Microsoft has released a set of patches for Windows XP, 2003, Vista, 2008, 7, and 2008 R2."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"vuln_publication_date", value:"2010/06/08"); script_set_attribute(attribute:"patch_publication_date", value:"2010/10/12"); script_set_attribute(attribute:"plugin_publication_date", value:"2010/10/13"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows"); script_set_attribute(attribute:"stig_severity", value:"II"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Windows : Microsoft Bulletins"); script_copyright(english:"This script is Copyright (C) 2010-2018 Tenable Network Security, Inc."); script_dependencies("smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl"); script_require_keys("SMB/MS_Bulletin_Checks/Possible"); script_require_ports(139, 445, 'Host/patch_management_checks'); exit(0); } include("audit.inc"); include("smb_hotfixes_fcheck.inc"); include("smb_hotfixes.inc"); include("smb_func.inc"); include("misc_func.inc"); get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible"); bulletin = 'MS10-083'; kbs = make_list("979687"); if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE); get_kb_item_or_exit("SMB/Registry/Enumerated"); get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1); if (hotfix_check_sp_range(xp:'3', win2003:'2', vista:'1,2', win7:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN); if (hotfix_check_server_core() == 1) audit(AUDIT_WIN_SERVER_CORE); rootfile = hotfix_get_systemroot(); if (!rootfile) exit(1, "Failed to get the system root."); share = hotfix_path2share(path:rootfile); if (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share); if ( # WordPad # Windows 7 / Server 2008 R2 hotfix_is_vulnerable(os:"6.1", file:"Ole32.dll", version:"6.1.7600.20744", min_version:"6.1.7600.20000", dir:"\system32", bulletin:bulletin, kb:"979687") || hotfix_is_vulnerable(os:"6.1", file:"Ole32.dll", version:"6.1.7600.16624", min_version:"6.1.7600.16000", dir:"\system32", bulletin:bulletin, kb:"979687") || # Vista / Windows Server 2008 hotfix_is_vulnerable(os:"6.0", sp:2, file:"Ole32.dll", version:"6.0.6002.22433", min_version:"6.0.6002.22000", dir:"\system32", bulletin:bulletin, kb:"979687") || hotfix_is_vulnerable(os:"6.0", sp:2, file:"Ole32.dll", version:"6.0.6002.18277", min_version:"6.0.6002.18000", dir:"\system32", bulletin:bulletin, kb:"979687") || hotfix_is_vulnerable(os:"6.0", sp:1, file:"Ole32.dll", version:"6.0.6001.22720", min_version:"6.0.6001.22000", dir:"\system32", bulletin:bulletin, kb:"979687") || hotfix_is_vulnerable(os:"6.0", sp:1, file:"Ole32.dll", version:"6.0.6001.18498", min_version:"6.0.6001.18000", dir:"\system32", bulletin:bulletin, kb:"979687") || # Windows 2003 / XP x64 hotfix_is_vulnerable(os:"5.2", file:"Ole32.dll", version:"5.2.3790.4750", dir:"\system32", bulletin:bulletin, kb:"979687") || # Windows XP hotfix_is_vulnerable(os:"5.1", file:"Ole32.dll", version:"5.1.2600.6010", dir:"\system32", bulletin:bulletin, kb:"979687") || # Windows Shell # Windows 7 / Server 2008 R2 hotfix_is_vulnerable(os:"6.1", file:"StructuredQuery.dll", version:"7.0.7600.20707", min_version:"7.0.7600.20000", dir:"\system32", bulletin:bulletin, kb:"979688") || hotfix_is_vulnerable(os:"6.1", file:"StructuredQuery.dll", version:"7.0.7600.16587", min_version:"7.0.7600.16000", dir:"\system32", bulletin:bulletin, kb:"979688") || # Vista / Windows Server 2008 hotfix_is_vulnerable(os:"6.0", file:"msshsq.dll", version:"7.0.6002.22398", min_version:"7.0.6002.22000", dir:"\system32", bulletin:bulletin, kb:"979688") || hotfix_is_vulnerable(os:"6.0", file:"msshsq.dll", version:"7.0.6002.18255", min_version:"7.0.6002.18000", dir:"\system32", bulletin:bulletin, kb:"979688") || hotfix_is_vulnerable(os:"6.0", file:"msshsq.dll", version:"6.0.6001.22685", min_version:"6.0.6001.22000", dir:"\system32", bulletin:bulletin, kb:"979688") || hotfix_is_vulnerable(os:"6.0", file:"msshsq.dll", version:"6.0.6001.18470", min_version:"6.0.6001.18000", dir:"\system32", bulletin:bulletin, kb:"979688") ) { set_kb_item(name:"SMB/Missing/MS10-083", value:TRUE); hotfix_security_hole(); hotfix_check_fversion_end(); exit(0); } else { hotfix_check_fversion_end(); audit(AUDIT_HOST_NOT, 'affected'); }NASL family Windows NASL id WIN_SERVER_2008_NTLM_PCI.NASL description According to the version number obtained by NTLM the remote host has Windows Server 2008 installed. The host may be vulnerable to a number of vulnerabilities including remote unauthenticated code execution. last seen 2020-06-01 modified 2020-06-02 plugin id 108811 published 2018-04-03 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/108811 title Windows Server 2008 Critical RCE Vulnerabilities (uncredentialed) (PCI/DSS) NASL family Windows : Microsoft Bulletins NASL id SMB_NT_MS10-036.NASL description The remote host contains a vulnerable version of Microsoft Office 2003 or 2007. Opening a specially crafted Office file can result in arbitrary code execution. A remote attacker can exploit this by tricking a user into opening a specially crafted Office file. last seen 2020-06-01 modified 2020-06-02 plugin id 46843 published 2010-06-09 reporter This script is Copyright (C) 2010-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/46843 title MS10-036: Vulnerability in COM Validation in Microsoft Office Could Allow Remote Code Execution (983235)
Oval
| accepted | 2014-08-18T04:06:26.100-04:00 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| class | vulnerability | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| contributors |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| definition_extensions |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| description | Windows Shell and WordPad in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7; Microsoft Office XP SP3; Office 2003 SP3; and Office System 2007 SP1 and SP2 do not properly validate COM objects during instantiation, which allows remote attackers to execute arbitrary code via a crafted file, aka "COM Validation Vulnerability." | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| family | windows | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| id | oval:org.mitre.oval:def:7286 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| status | accepted | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| submitted | 2010-03-09T13:00:00 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| title | COM Validation Vulnerability | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| version | 104 |
Seebug
| bulletinFamily | exploit |
| description | BUGTRAQ ID: 40574 CVE ID: CVE-2010-1263 Microsoft Office是非常流行的办公软件套件。 Office中的组件在实例化对象时没有充分地验证COM对象，用户受骗打开了恶意的Excel、PowerPoint、Publisher、Visio 或Word文档就会导致执行任意代码。 Microsoft Office XP SP3 Microsoft Office 2007 SP2 Microsoft Office 2007 SP1 Microsoft Office 2003 Service Pack 3 临时解决方法： * 不要打开从不受信任来源或从受信任来源意外收到的Office文件。 厂商补丁： Microsoft --------- Microsoft已经为此发布了一个安全公告（MS10-036）以及相应补丁: MS10-036：Vulnerability in COM Validation in Microsoft Office Could Allow Remote Code Execution (983235) 链接：http://www.microsoft.com/technet/security/bulletin/MS10-036.mspx?pf=true |
| id | SSV:19776 |
| last seen | 2017-11-19 |
| modified | 2010-06-10 |
| published | 2010-06-10 |
| reporter | Root |
| title | Microsoft Office COM对象验证远程代码执行漏洞（MS10-036） |
References
- http://www.securityfocus.com/bid/40574
- http://www.securitytracker.com/id?1024555
- http://www.us-cert.gov/cas/techalerts/TA10-159B.html
- http://www.us-cert.gov/cas/techalerts/TA10-285A.html
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-036
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-083
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7286