Vulnerabilities > CVE-2011-3412 - Code Injection vulnerability in Microsoft Publisher 2003/2007

047910
CVSS 9.3 - CRITICAL
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
microsoft
CWE-94
critical
nessus

Summary

Microsoft Publisher 2003 SP3, and 2007 SP2 and SP3, allows remote attackers to execute arbitrary code via a crafted Publisher file that leverages incorrect memory handling, aka "Publisher Memory Corruption Vulnerability."

Vulnerable Configurations

Part Description Count
Application
Microsoft
3

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Leverage Executable Code in Non-Executable Files
    An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high. The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/) http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process. The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality. The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
  • Manipulating User-Controlled Variables
    This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An attacker can override environment variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the attacker can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.

Msbulletin

bulletin_idMS11-091
bulletin_url
date2011-12-13T00:00:00
impactRemote Code Execution
knowledgebase_id2607702
knowledgebase_url
severityImportant
titleVulnerabilities in Microsoft Publisher Could Allow Remote Code Execution

Nessus

NASL familyWindows : Microsoft Bulletins
NASL idSMB_NT_MS11-091.NASL
descriptionThe Publisher component of Microsoft Office installed on the remote host is affected by multiple vulnerabilities : - The application could allow overwriting function pointers in memory. (CVE-2011-1508) - The application could allow indexing an out-of-bounds array in memory. (CVE-2011-3410) - The application has an invalid pointer vulnerability. (CVE-2011-3411) - The application has a memory corruption vulnerability. (CVE-2011-3412) A remote attacker could exploit these by tricking a user into opening a specially crafted Publisher file, resulting in remote code execution.
last seen2020-06-01
modified2020-06-02
plugin id57277
published2011-12-13
reporterThis script is Copyright (C) 2011-2018 Tenable Network Security, Inc.
sourcehttps://www.tenable.com/plugins/nessus/57277
titleMS11-091: Vulnerabilities in Microsoft Publisher Could Allow Remote Code Execution (2607702)
code
#
# (C) Tenable Network Security, Inc.
#


include("compat.inc");


if (description)
{
  script_id(57277);
  script_version("1.19");
  script_cvs_date("Date: 2018/11/15 20:50:31");

  script_cve_id("CVE-2011-1508", "CVE-2011-3410", "CVE-2011-3411", "CVE-2011-3412");
  script_bugtraq_id(50090, 50943, 50949, 50955);
  script_xref(name:"CERT", value:"361441");
  script_xref(name:"MSFT", value:"MS11-091");
  script_xref(name:"MSKB", value:"2553084");
  script_xref(name:"MSKB", value:"2596705");

  script_name(english:"MS11-091: Vulnerabilities in Microsoft Publisher Could Allow Remote Code Execution (2607702)");
  script_summary(english:"Checks the version of Publisher");

  script_set_attribute(
    attribute:"synopsis",
    value:
"The version of Microsoft Office installed on the remote host has
multiple vulnerabilities."
  );
  script_set_attribute(
    attribute:"description",
    value:
"The Publisher component of Microsoft Office installed on the remote
host is affected by multiple vulnerabilities :

  - The application could allow overwriting function
    pointers in memory. (CVE-2011-1508)

  - The application could allow indexing an out-of-bounds
    array in memory. (CVE-2011-3410)

  - The application has an invalid pointer vulnerability.
    (CVE-2011-3411)

  - The application has a memory corruption vulnerability.
    (CVE-2011-3412)

A remote attacker could exploit these by tricking a user into opening
a specially crafted Publisher file, resulting in remote code
execution."
  );
  script_set_attribute(attribute:"see_also", value:"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2011/ms11-091");
  script_set_attribute(
    attribute:"solution",
    value:
"Microsoft has released a set of patches for Microsoft Office 2003
and 2007."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2011/10/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2011/12/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2011/12/13");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:office");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows : Microsoft Bulletins");

  script_copyright(english:"This script is Copyright (C) 2011-2018 Tenable Network Security, Inc.");

  script_dependencies("smb_nt_ms02-031.nasl", "office_installed.nasl", "ms_bulletin_checks_possible.nasl");
  script_require_keys("SMB/MS_Bulletin_Checks/Possible");
  script_require_ports(139, 445, 'Host/patch_management_checks');

  exit(0);
}


include("smb_hotfixes_fcheck.inc");
include("smb_hotfixes.inc");
include("misc_func.inc");
include("audit.inc");

get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");


bulletin = 'MS11-091';
kbs = make_list("2553084", "2596705");
if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);

installs = get_kb_list_or_exit("SMB/Office/Publisher/*/ProductPath");
vuln = FALSE;
foreach install (keys(installs))
{
  version = install - 'SMB/Office/Publisher/' - '/ProductPath';
  path = installs[install];
  if (isnull(path)) path = 'n/a';

  v = split(version, sep:'.', keep:FALSE);
  for (i = 0; i < max_index(v); i++)
    v[i] = int(v[i]);


  kb = "";
  # Office 2003 SP3
  if (v[0] == 11 && v[1] == 0 && v[2] < 8342)
  {
    vuln = TRUE;
    info = '\n  Product           : Publisher 2003'+
           '\n  File              : '+path+
           '\n  Installed version : '+version+
           '\n  Fixed version     : 11.0.8342.0\n';
    kb = "2553084";
  }
  # Office 2007 SP2/SP3
  else if (v[0] == 12 && v[1] == 0 && (v[2] < 6652 || (v[2] == 6652 && v[3] < 5000)))
  {
    vuln = TRUE;
    info = '\n  Product           : Publisher 2007'+
           '\n  File              : '+path+
           '\n  Installed version : '+version+
           '\n  Fixed version     : 12.0.6652.5000\n';
    kb = "2596705";
  }
}

if (vuln)
{
  set_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);
  hotfix_add_report(info, bulletin:bulletin, kb:kb);
  hotfix_security_hole();
  exit(0);
}
else audit(AUDIT_HOST_NOT, 'affected');

Oval

accepted2014-08-18T04:01:08.410-04:00
classvulnerability
contributors
  • nameJosh Turpin
    organizationSymantec Corporation
  • nameShane Shaffer
    organizationG2, Inc.
  • nameMaria Kedovskaya
    organizationALTX-SOFT
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
definition_extensions
  • commentMicrosoft Publisher 2003 is installed
    ovaloval:org.mitre.oval:def:239
  • commentMicrosoft Publisher 2007 is installed
    ovaloval:org.mitre.oval:def:2127
descriptionMicrosoft Publisher 2003 SP3, and 2007 SP2 and SP3, allows remote attackers to execute arbitrary code via a crafted Publisher file that leverages incorrect memory handling, aka "Publisher Memory Corruption Vulnerability."
familywindows
idoval:org.mitre.oval:def:14808
statusaccepted
submitted2011-12-13T13:00:00
titlePublisher Memory Corruption Vulnerability
version14

Seebug

bulletinFamilyexploit
descriptionBUGTRAQ ID: 50955 CVE ID: CVE-2011-3412 Microsoft Publisher是微软公司发行的桌面出版应用软件。 Microsoft Publisher处理特制.pub文件的方式中存在远程代码执行漏洞,成功利用后可允许攻击者以当前用户权限执行任意代码 Microsoft Publisher 2007 SP3 Microsoft Publisher 2007 SP2 Microsoft Publisher 2007 SP1 Microsoft Publisher 2003 SP3 Microsoft Publisher 2003 SP3 临时解决方法: * 不要打开可疑源接收到的或从可信源意外接收到的Office文件。 厂商补丁: Microsoft --------- Microsoft已经为此发布了一个安全公告(MS11-091)以及相应补丁: MS11-091:Vulnerabilities in Microsoft Publisher Could Allow Remote Code Execution (2607702) 链接:http://www.microsoft.com/technet/security/bulletin/MS11-091.asp
idSSV:26057
last seen2017-11-19
modified2011-12-15
published2011-12-15
reporterRoot
titleMicrosoft Publisher远程内存破坏漏洞(MS11-091)