Vulnerabilities > CVE-2010-3329 - Code Injection vulnerability in Microsoft Internet Explorer 7/8
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN Summary
mshtmled.dll in Microsoft Internet Explorer 7 and 8 allows remote attackers to execute arbitrary code via a crafted Microsoft Office document that causes the HtmlDlgHelper class destructor to access uninitialized memory, aka "Uninitialized Memory Corruption Vulnerability."
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 2 | |
| OS | Microsoft
| 19 |
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Leverage Executable Code in Non-Executable Files An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high. The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/) http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process. The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality. The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
- Manipulating User-Controlled Variables This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An attacker can override environment variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the attacker can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.
Exploit-Db
| description | Microsoft Office HtmlDlgHelper Class Memory Corruption. CVE-2010-3329. Dos exploit for windows platform |
| id | EDB-ID:15262 |
| last seen | 2016-02-01 |
| modified | 2010-10-16 |
| published | 2010-10-16 |
| reporter | Core Security |
| source | https://www.exploit-db.com/download/15262/ |
| title | Microsoft Office HtmlDlgHelper Class Memory Corruption |
Msbulletin
| bulletin_id | MS10-071 |
| bulletin_url | |
| date | 2010-10-12T00:00:00 |
| impact | Remote Code Execution |
| knowledgebase_id | 2360131 |
| knowledgebase_url | |
| severity | Critical |
| title | Cumulative Security Update for Internet Explorer |
Nessus
| NASL family | Windows : Microsoft Bulletins |
| NASL id | SMB_NT_MS10-071.NASL |
| description | The remote host is missing IE Security Update 2360131. The remote version of IE is affected by several vulnerabilities that may allow an attacker to execute arbitrary code on the remote host. |
| last seen | 2020-06-01 |
| modified | 2020-06-02 |
| plugin id | 49948 |
| published | 2010-10-13 |
| reporter | This script is Copyright (C) 2010-2018 Tenable Network Security, Inc. |
| source | https://www.tenable.com/plugins/nessus/49948 |
| title | MS10-071: Cumulative Security Update for Internet Explorer (2360131) |
| code | |
Oval
| accepted | 2014-08-18T04:06:29.298-04:00 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| class | vulnerability | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| contributors |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| definition_extensions |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| description | mshtmled.dll in Microsoft Internet Explorer 7 and 8 allows remote attackers to execute arbitrary code via a crafted Microsoft Office document that causes the HtmlDlgHelper class destructor to access uninitialized memory, aka "Uninitialized Memory Corruption Vulnerability." | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| family | windows | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| id | oval:org.mitre.oval:def:7482 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| status | accepted | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| submitted | 2010-10-12T13:00:00 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| title | Uninitialized Memory Corruption Vulnerability (CVE-2010-3329) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| version | 79 |
Packetstorm
| data source | https://packetstormsecurity.com/files/download/94815/CORE-2010-0517.txt |
| id | PACKETSTORM:94815 |
| last seen | 2016-12-05 |
| published | 2010-10-15 |
| reporter | Core Security Technologies |
| source | https://packetstormsecurity.com/files/94815/Core-Security-Technologies-Advisory-2010.0517.html |
| title | Core Security Technologies Advisory 2010.0517 |
Seebug
bulletinFamily exploit description No description provided by source. id SSV:20184 last seen 2017-11-19 modified 2010-10-17 published 2010-10-17 reporter Root source https://www.seebug.org/vuldb/ssvid-20184 title Microsoft Office HtmlDlgHelper Class Memory Corruption bulletinFamily exploit description BUGTRAQ ID: 43696,43705,43706,43707 CVE ID: CVE-2010-3326,CVE-2010-3328,CVE-2010-3329,CVE-2010-3331 Internet Explorer是Windows操作系统中默认捆绑的WEB浏览器。 Internet Explorer访问未正确初始化或已被删除的对象的方式中存在远程执行代码漏洞。攻击者可以通过构建特制的网页来利用该漏洞，当用户查看网页时，该漏洞可能允许远程执行代码。成功利用此漏洞的攻击者可以获得与登录用户相同的用户权限。如果用户使用管理用户权限登录，成功利用此漏洞的攻击者便可完全控制受影响的系统。 Microsoft Internet Explorer 8.0 Microsoft Internet Explorer 7.0 Microsoft Internet Explorer 6.0 临时解决方法： * 将Internet Explorer配置为在Internet和本地Intranet安全区域中运行ActiveX控件和活动脚本之前进行提示。 * 将Internet 和本地Intranet安全区域设置设为“高”，以便在这些区域中运行ActiveX控件和活动脚本之前进行提示。 厂商补丁： Microsoft --------- Microsoft已经为此发布了一个安全公告（MS10-071）以及相应补丁: MS10-071：Cumulative Security Update for Internet Explorer (2360131) 链接：http://www.microsoft.com/technet/security/bulletin/MS10-071.mspx?pf=true id SSV:20170 last seen 2017-11-19 modified 2010-10-15 published 2010-10-15 reporter Root title Microsoft IE多个未初始化内存远程代码执行漏洞（MS10-071） bulletinFamily exploit description BUGTRAQ ID: 43706 CVE ID: CVE-2010-3329 Internet Explorer是Windows操作系统中默认捆绑的WEB浏览器。 Windows在实例化Office文档（如.XLS、.DOC）中HtmlDlgHelper类对象（CLASSID: 3050f4e1-98b5-11cf-bb82-00aa00bdce0b）的方式存在内存破坏漏洞。有漏洞的模块是Internet Explorer中的mshtmled.dll，当调用CHtmlDlgHelper类的析构程序之后访问未初始化内存时就会在mshtmled.dll 中触发这个漏洞。以下是出现了漏洞的代码段： mshtmled!ReleaseInterface: 42b919c0 8bff mov edi,edi 42b919c2 55 push ebp 42b919c3 8bec mov ebp,esp 42b919c5 8b4508 mov eax,dword ptr [ebp+8] ss:0023:0013d104=00310065 42b919c8 85c0 test eax,eax 42b919ca 7406 je mshtmled!ReleaseInterface+0x12 (42b919d2) [br=0] 42b919cc 8b08 mov ecx,dword ptr [eax] ds:0023:00310065 42b919ce 50 push eax 42b919cf ff5108 call dword ptr [ecx+8] ds:0023:7d02029c=2a2c277a eax=00310065 ebx=00000000 ecx=7d020294 edx=df0b3d60 esi=001edbdc edi=00000000 eip=2a2c277a esp=0013d0f4 ebp=0013d0fc iopl=0 nv up ei pl nz na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000206 Stack Trace: <Unloaded_ion.dll>+0x2a2c2779 mshtmled!ReleaseInterface+0x12 mshtmled!CHtmlDlgHelper::~CHtmlDlgHelper+0x10 mshtmled!ATL::CComAggObject<CHtmlDlgHelper>::`scalar deleting destructor'+0xd mshtmled!ATL::CComAggObject<CHtmlDlgHelper>::Release+0x27 VBE6!rtcStrConvVar+0xbd65 VBE6!rtcSetDatabaseLcid+0xa823 EXCEL!Ordinal41+0xd2ad0 EXCEL!Ordinal41+0x14082a USER32!CallWindowProcW+0x1b Instruction Address: 0x000000002a2c277a Microsoft Internet Explorer 8.0 Microsoft Internet Explorer 7.0 临时解决方法： * 禁止在Internet Explorer中运行COM对象。 如果要对CLSID值{3050f4e1-98b5-11cf-bb82-00aa00bdce0b}设置kill bit，在文本编辑器（如写字板）中粘贴以下文本然后使用.reg文件名扩展保存文件。 Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{3050f4e1-98b5-11cf-bb82-00aa00bdce0b}] "Compatibility Flags"=dword:00000400 通过双击将这个.reg文件应用到单个系统。 厂商补丁： Microsoft --------- Microsoft已经为此发布了一个安全公告（MS10-071）以及相应补丁: MS10-071：Cumulative Security Update for Internet Explorer (2360131) 链接：http://www.microsoft.com/technet/security/bulletin/MS10-071.mspx?pf=true id SSV:20169 last seen 2017-11-19 modified 2010-10-15 published 2010-10-15 reporter Root source https://www.seebug.org/vuldb/ssvid-20169 title Microsoft IE HtmlDlgHelper类内存破坏漏洞（MS10-071）
References
- http://support.avaya.com/css/P8/documents/100113324
- http://support.avaya.com/css/P8/documents/100113324
- http://www.securityfocus.com/bid/43706
- http://www.securityfocus.com/bid/43706
- http://www.us-cert.gov/cas/techalerts/TA10-285A.html
- http://www.us-cert.gov/cas/techalerts/TA10-285A.html
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-071
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-071
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7482
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7482