Vulnerabilities > CVE-2011-1508 - Code Injection vulnerability in Microsoft Publisher 2003/2007
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
COMPLETE Integrity impact
COMPLETE Availability impact
COMPLETE Summary
Microsoft Publisher 2003 SP3, and 2007 SP2 and SP3, does not properly manage memory allocations for function pointers, which allows user-assisted remote attackers to execute arbitrary code via a crafted Publisher file, aka "Publisher Function Pointer Overwrite Vulnerability."
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 3 |
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Leverage Executable Code in Non-Executable Files An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high. The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/) http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process. The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality. The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
- Manipulating User-Controlled Variables This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An attacker can override environment variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the attacker can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.
Nessus
| NASL family | Windows : Microsoft Bulletins |
| NASL id | SMB_NT_MS11-091.NASL |
| description | The Publisher component of Microsoft Office installed on the remote host is affected by multiple vulnerabilities : - The application could allow overwriting function pointers in memory. (CVE-2011-1508) - The application could allow indexing an out-of-bounds array in memory. (CVE-2011-3410) - The application has an invalid pointer vulnerability. (CVE-2011-3411) - The application has a memory corruption vulnerability. (CVE-2011-3412) A remote attacker could exploit these by tricking a user into opening a specially crafted Publisher file, resulting in remote code execution. |
| last seen | 2020-06-01 |
| modified | 2020-06-02 |
| plugin id | 57277 |
| published | 2011-12-13 |
| reporter | This script is Copyright (C) 2011-2018 Tenable Network Security, Inc. |
| source | https://www.tenable.com/plugins/nessus/57277 |
| title | MS11-091: Vulnerabilities in Microsoft Publisher Could Allow Remote Code Execution (2607702) |
| code | |
Oval
| accepted | 2014-08-18T04:01:08.950-04:00 | ||||||||||||||||
| class | vulnerability | ||||||||||||||||
| contributors |
| ||||||||||||||||
| definition_extensions |
| ||||||||||||||||
| description | Microsoft Publisher 2003 SP3, and 2007 SP2 and SP3, does not properly manage memory allocations for function pointers, which allows user-assisted remote attackers to execute arbitrary code via a crafted Publisher file, aka "Publisher Function Pointer Overwrite Vulnerability." | ||||||||||||||||
| family | windows | ||||||||||||||||
| id | oval:org.mitre.oval:def:14816 | ||||||||||||||||
| status | accepted | ||||||||||||||||
| submitted | 2011-12-13T13:00:00 | ||||||||||||||||
| title | Publisher Function Pointer Overwrite Vulnerability | ||||||||||||||||
| version | 14 |
Seebug
bulletinFamily exploit description CVE ID: CVE-2011-1508 .NET Framework是用于Windows的新托管代码编程模型，用于构建具有视觉上引人注目的用户体验的应用程序，实现跨技术边界的无缝通信，并且能支持各种业务流程。Silverlight 是一种新的 Web 呈现技术，能在各种平台上运行。 Microsoft .NET Framework和Microsoft Silverlight在类继承的实现上存在安全漏洞，恶意用户可通过特制的网页利用此漏洞控制用户系统。要成功利用，需要浏览器可以运行XBAPs或Silverlight应用程序。 Microsoft .NET Framework 4.x Microsoft .NET Framework 3.x Microsoft .NET Framework 2.x Microsoft .NET Framework 1.x Microsoft Silverlight 4.x 临时解决方法： 如果您不能立刻安装补丁或者升级，NSFOCUS建议您采取以下措施以降低威胁： * 在IE中禁用XAML浏览器应用 * 临时阻止IE中的Microsoft Silverlight ActiveX控件。 * 临时阻止Firefox或Chrome中的Microsoft Silverlight ActiveX控件。 * 使用交互方式。 * 使用注册表文件 厂商补丁： Microsoft --------- Microsoft已经为此发布了一个安全公告（MS11-078）以及相应补丁: MS11-078：Vulnerability in .NET Framework and Microsoft Silverlight Could Allow Remote Code Execution (2604930) 链接：http://www.microsoft.com/technet/security/bulletin/MS11-078.asp id SSV:21014 last seen 2017-11-19 modified 2011-10-13 published 2011-10-13 reporter Root title Microsoft .NET Framework / Silverlight类继承限制漏洞(MS11-078) bulletinFamily exploit description CVE ID: CVE-2011-1508 Microsoft Publisher是微软公司发行的桌面出版应用软件。 Publisher 2007中存在输入验证错误，可被远程攻击者利用通过诱使用户在文档中插入特制的.pub文件执行任意代码。 通过修改.pub文件，可使pubconv.dll库复制很多文件内容到栈中，从而覆盖稍后执行的函数指针。 Microsoft Publisher 2007 (12.0.6546.5000) 厂商补丁： Microsoft --------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.microsoft.com/technet/security/ id SSV:21015 last seen 2017-11-19 modified 2011-10-13 published 2011-10-13 reporter Root title Microsoft Publisher 2007 Pubconv.dll内存破坏漏洞