Vulnerabilities > CVE-2012-0183 - RTF Data Handling Remote Memory Corruption vulnerability in Microsoft Office, Office Compatibility Pack and Word
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
COMPLETE Integrity impact
COMPLETE Availability impact
COMPLETE Summary
Microsoft Word 2003 SP3 and 2007 SP2 and SP3, Office 2008 and 2011 for Mac, and Office Compatibility Pack SP2 and SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted RTF data, aka "RTF Mismatch Vulnerability."
Vulnerable Configurations
Part | Description | Count |
---|---|---|
Application | 6 |
Msbulletin
bulletin_id | MS12-029 |
bulletin_url | |
date | 2012-05-08T00:00:00 |
impact | Remote Code Execution |
knowledgebase_id | 2680352 |
knowledgebase_url | |
severity | Critical |
title | Vulnerability in Microsoft Word Could Allow Remote Code Execution |
Nessus
NASL family Windows : Microsoft Bulletins NASL id SMB_NT_MS12-029.NASL description The version of Office and/or Office Compatibility Pack installed on the remote host has a memory corruption vulnerability. A remote attacker could exploit this by tricking a user into opening a specially crafted RTF file, resulting in arbitrary code execution. last seen 2020-06-01 modified 2020-06-02 plugin id 59037 published 2012-05-09 reporter This script is Copyright (C) 2012-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/59037 title MS12-029: Vulnerability in Microsoft Word Could Allow Remote Code Execution (2680352) code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(59037); script_version("1.21"); script_cvs_date("Date: 2018/11/15 20:50:31"); script_cve_id("CVE-2012-0183"); script_bugtraq_id(53344); script_xref(name:"MSFT", value:"MS12-029"); script_xref(name:"MSKB", value:"2596880"); script_xref(name:"MSKB", value:"2596917"); script_xref(name:"MSKB", value:"2598332"); script_name(english:"MS12-029: Vulnerability in Microsoft Word Could Allow Remote Code Execution (2680352)"); script_summary(english:"Checks file versions"); script_set_attribute( attribute:"synopsis", value: "A Microsoft Office component installed on the remote host has a memory corruption vulnerability." ); script_set_attribute( attribute:"description", value: "The version of Office and/or Office Compatibility Pack installed on the remote host has a memory corruption vulnerability. A remote attacker could exploit this by tricking a user into opening a specially crafted RTF file, resulting in arbitrary code execution." ); script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-12-186/"); script_set_attribute(attribute:"see_also", value:"https://seclists.org/fulldisclosure/2012/Nov/112"); script_set_attribute(attribute:"see_also", value:"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2012/ms12-029"); script_set_attribute( attribute:"solution", value: "Microsoft has released a set of patches for Office 2003, 2007, and Office Compatibility Pack." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploited_by_malware", value:"true"); script_set_attribute(attribute:"vuln_publication_date", value:"2012/05/08"); script_set_attribute(attribute:"patch_publication_date", value:"2012/05/08"); script_set_attribute(attribute:"plugin_publication_date", value:"2012/05/09"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:office"); script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:word"); script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:office_compatibility_pack"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Windows : Microsoft Bulletins"); script_copyright(english:"This script is Copyright (C) 2012-2018 Tenable Network Security, Inc."); script_dependencies("smb_nt_ms02-031.nasl", "office_installed.nasl", "smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl"); script_require_keys("SMB/MS_Bulletin_Checks/Possible"); script_require_ports(139, 445, "Host/patch_management_checks"); exit(0); } include("smb_func.inc"); include("smb_hotfixes.inc"); include("smb_hotfixes_fcheck.inc"); include("misc_func.inc"); include("audit.inc"); get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible"); bulletin = 'MS12-029'; kbs = make_list('2596880', '2596917', '2598332'); if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE); kb = ""; vuln = FALSE; # Word. installs = get_kb_list("SMB/Office/Word/*/ProductPath"); if (!isnull(installs)) { foreach install (keys(installs)) { info = ""; version = install - 'SMB/Office/Word/' - '/ProductPath'; path = installs[install]; if (isnull(path)) path = 'n/a'; ver = split(version, sep:'.', keep:FALSE); for (i=0; i<max_index(ver); i++) ver[i] = int(ver[i]); # Word 2007 office_sp = get_kb_item("SMB/Office/2007/SP"); if ( (!isnull(office_sp) && (office_sp == 2 || office_sp == 3)) && ( ver[0] == 12 && ver[1] == 0 && ( ver[2] < 6661 || (ver[2] == 6661 && ver[3] < 5000) ) ) ) { info = '\n Product : Word 2007' + '\n File : ' + path + '\n Installed version : ' + version + '\n Fixed version : 12.0.6661.5000' + '\n'; kb = "2596917"; } # Word 2003 office_sp = get_kb_item("SMB/Office/2003/SP"); if ((!isnull(office_sp) && (office_sp == 3)) && (ver[0] == 11 && ver[1] == 0 && ver[2] < 8345)) { info = '\n Product : Word 2003' + '\n File : ' + path + '\n Installed version : ' + version + '\n Fixed version : 11.0.8345.0' + '\n'; kb = "2598332"; } if (info) { hotfix_add_report(info, bulletin:bulletin, kb:kb); vuln = TRUE; } } } # 2007 Microsoft Office system and the Microsoft Office Compatibility Pack. installs = get_kb_list("SMB/Office/WordCnv/*/ProductPath"); if (!isnull(installs)) { foreach install (keys(installs)) { version = install - 'SMB/Office/WordCnv/' - '/ProductPath'; path = installs[install]; if (path) { share = hotfix_path2share(path:path); if (is_accessible_share(share:share)) { path = path - '\\Wordconv.exe'; old_report = hotfix_get_report(); check_file = "wordcnv.dll"; if (version =~ '^12\\.0' && hotfix_check_fversion(path:path, file:check_file, version:"12.0.6661.5000") == HCF_OLDER) { file = ereg_replace(pattern:"^[A-Za-z]:(.*)", string:path, replace:"\1\" + check_file); kb_name = "SMB/FileVersions/"+tolower(share-'$')+tolower(str_replace(string:file, find:"\", replace:"/")); version = get_kb_item(kb_name); info = '\n Product : Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats' + '\n File : ' + path + '\\' + check_file + '\n Installed version : ' + version + '\n Fixed version : 12.0.6661.5000' + '\n'; hcf_report = ''; hotfix_add_report(old_report + info, bulletin:bulletin, kb:"2596880"); vuln = TRUE; } } } } hotfix_check_fversion_end(); } if (vuln) { set_kb_item(name:'SMB/Missing/' + bulletin, value:TRUE); hotfix_security_hole(); exit(0); } else { audit(AUDIT_HOST_NOT, 'affected'); }
NASL family MacOS X Local Security Checks NASL id MACOSX_MS_OFFICE_MAY2012.NASL description The remote Mac OS X host is running a version of Microsoft Office that is affected by the following vulnerabilities : - A memory corruption vulnerability could be triggered when parsing specially crafted RTF-formatted data. (CVE-2012-0183) - Several memory corruption vulnerabilities could be triggered when reading a specially crafted Excel file. (CVE-2012-0141 / CVE-2012-0142 / CVE-2012-0143 / CVE-2012-0184) - A record parsing mismatch exists when opening a specially crafted Excel file. (CVE-2012-1847) If a remote attacker can trick a user into opening a malicious file using the affected install, these vulnerabilities could be leveraged to execute arbitrary code subject to the user last seen 2019-10-28 modified 2012-05-09 plugin id 59046 published 2012-05-09 reporter This script is Copyright (C) 2012-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/59046 title MS12-029 / MS12-030: Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (2680352 / 2663830) (Mac OS X) code #TRUSTED 221a39e638e056ce0e8a4e697dd027a317c87115e76eee2216515d932a692995e50d4de42537c8dcac0632360d3ba2286005b9f5461c2823a36a1af2d96637a932573779fd5121d51f936f8b03efa148a601cf701506d0e55b5bdfa629bacbbb92cc0e79d76704be82d855fea363df8b9adee90b54b66c5a2c4bd54a992c931e95a4966b160ae0ff4134a73e0ae5244b4558f56301e0c2511992bd25f4da4a2e0ca5abc374660a5267dfec66d7c788fbcc8705045fdbaf7d2d9d7ed3e8dad8ac1f9ddeae6852c475200c415c9745f990dfdb5831384ac571d18555f2a7093448399000b19d43612348cba3b162c4bd1bddb2c15e0f65802acabdc1553183cfdf76402bebb2ae7fd338c4de0ad5a3a8b6157ed1c19f3ed0b448aabd5c0876fd55c992d0c657a98edaf12c25312dafffb242ab3210dfcf3ca88880b2cf47cdca718bdb2ba91ca963e0fdbdf1978779913b540f9569f43d5ba7191b842fab0be891ecb472851d7832c1a95675fc96ceff9a836337b9872115acd66fa756bd415385901137a8fe637bfa72f84f1792537f437d83ce505fc48fd74912cd9f89ea2dfab3af4f16588f691a952a03320113c26f0bb7caeabb39cbed3a600797a0015a70812f8696d4da6ca682491b7ae5733103b6d9d1025045b190645fbe689b0184aa7e7060f1ee827845fe826b5fb54a8f045508ba1d3d1ac1290f09b222de0b4b2a # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(59046); script_version("1.18"); script_set_attribute(attribute:"plugin_modification_date", value:"2018/07/14"); script_cve_id( "CVE-2012-0141", "CVE-2012-0142", "CVE-2012-0143", "CVE-2012-0183", "CVE-2012-0184", "CVE-2012-1847" ); script_bugtraq_id(53342, 53344, 53373, 53374, 53375, 53379); script_xref(name:"MSFT", value:"MS12-029"); script_xref(name:"MSFT", value:"MS12-030"); script_xref(name:"MSKB", value:"2665346"); script_xref(name:"MSKB", value:"2665351"); script_name(english:"MS12-029 / MS12-030: Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (2680352 / 2663830) (Mac OS X)"); script_summary(english:"Check version of Microsoft Office"); script_set_attribute(attribute:"synopsis", value: "An application installed on the remote Mac OS X host is affected by multiple remote code execution vulnerabilities."); script_set_attribute(attribute:"description", value: "The remote Mac OS X host is running a version of Microsoft Office that is affected by the following vulnerabilities : - A memory corruption vulnerability could be triggered when parsing specially crafted RTF-formatted data. (CVE-2012-0183) - Several memory corruption vulnerabilities could be triggered when reading a specially crafted Excel file. (CVE-2012-0141 / CVE-2012-0142 / CVE-2012-0143 / CVE-2012-0184) - A record parsing mismatch exists when opening a specially crafted Excel file. (CVE-2012-1847) If a remote attacker can trick a user into opening a malicious file using the affected install, these vulnerabilities could be leveraged to execute arbitrary code subject to the user's privileges."); script_set_attribute(attribute:"see_also", value:"http://www.zerodayinitiative.com/advisories/ZDI-12-157/"); script_set_attribute(attribute:"see_also", value:"http://seclists.org/fulldisclosure/2012/Aug/279"); script_set_attribute(attribute:"see_also", value:"http://technet.microsoft.com/en-us/security/bulletin/ms12-029"); script_set_attribute(attribute:"see_also", value:"http://technet.microsoft.com/en-us/security/bulletin/ms12-030"); script_set_attribute(attribute:"solution", value: "Microsoft has released patches for Office for Mac 2011 and Office 2008 for Mac."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploited_by_malware", value:"true"); script_set_attribute(attribute:"vuln_publication_date", value:"2012/05/08"); script_set_attribute(attribute:"patch_publication_date", value:"2012/05/08"); script_set_attribute(attribute:"plugin_publication_date", value:"2012/05/09"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:office:2008::mac"); script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:office:2011::mac"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"MacOS X Local Security Checks"); script_copyright(english:"This script is Copyright (C) 2012-2018 Tenable Network Security, Inc."); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/MacOSX/Version"); exit(0); } include("global_settings.inc"); include("misc_func.inc"); include("ssh_func.inc"); include("macosx_func.inc"); if(sshlib::get_support_level() >= sshlib::SSH_LIB_SUPPORTS_COMMANDS) enable_ssh_wrappers(); else disable_ssh_wrappers(); if (!get_kb_item("Host/local_checks_enabled")) exit(0, "Local checks are not enabled."); os = get_kb_item("Host/MacOSX/Version"); if (!os) exit(0, "The host does not appear to be running Mac OS X."); # Gather version info. info = ''; installs = make_array(); prod = 'Office for Mac 2011'; plist = "/Applications/Microsoft Office 2011/Office/MicrosoftComponentPlugin.framework/Versions/14/Resources/Info.plist"; cmd = 'cat \'' + plist + '\' | ' + 'grep -A 1 CFBundleShortVersionString | ' + 'tail -n 1 | ' + 'sed \'s/.*string>\\(.*\\)<\\/string>.*/\\1/g\''; version = exec_cmd(cmd:cmd); if (version && version =~ "^[0-9]+\.") { version = chomp(version); if (version !~ "^14\.") exit(1, "Failed to get the version for "+prod+" - '"+version+"'."); installs[prod] = version; ver = split(version, sep:'.', keep:FALSE); for (i=0; i<max_index(ver); i++) ver[i] = int(ver[i]); fixed_version = '14.2.2'; fix = split(fixed_version, sep:'.', keep:FALSE); for (i=0; i<max_index(fix); i++) fix[i] = int(fix[i]); for (i=0; i<max_index(fix); i++) if ((ver[i] < fix[i])) { info += '\n Product : ' + prod + '\n Installed version : ' + version + '\n Fixed version : ' + fixed_version + '\n'; break; } else if (ver[i] > fix[i]) break; } prod = 'Office 2008 for Mac'; plist = "/Applications/Microsoft Office 2008/Office/MicrosoftComponentPlugin.framework/Versions/12/Resources/Info.plist"; cmd = 'cat \'' + plist + '\' | ' + 'grep -A 1 CFBundleShortVersionString | ' + 'tail -n 1 | ' + 'sed \'s/.*string>\\(.*\\)<\\/string>.*/\\1/g\''; version = exec_cmd(cmd:cmd); if (version && version =~ "^[0-9]+\.") { version = chomp(version); if (version !~ "^12\.") exit(1, "Failed to get the version for "+prod+" - '"+version+"'."); installs[prod] = version; fixed_version = '12.3.3'; if (ver_compare(ver:version, fix:fixed_version, strict:FALSE) == -1) { info += '\n Product : ' + prod + '\n Installed version : ' + version + '\n Fixed version : ' + fixed_version + '\n'; } } # Report findings. if (info) { if (report_verbosity > 0) security_hole(port:0, extra:info); else security_hole(0); exit(0); } else { if (max_index(keys(installs)) == 0) exit(0, "Office for Mac is not installed."); else { msg = 'The host has '; foreach prod (sort(keys(installs))) msg += prod + ' ' + installs[prod] + ' and '; msg = substr(msg, 0, strlen(msg)-1-strlen(' and ')); msg += ' installed and thus is not affected.'; exit(0, msg); } }
Oval
accepted | 2014-06-30T04:05:40.358-04:00 | ||||||||||||
class | vulnerability | ||||||||||||
contributors |
| ||||||||||||
definition_extensions |
| ||||||||||||
description | Microsoft Word 2003 SP3 and 2007 SP2 and SP3, Office 2008 and 2011 for Mac, and Office Compatibility Pack SP2 and SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted RTF data, aka "RTF Mismatch Vulnerability." | ||||||||||||
family | windows | ||||||||||||
id | oval:org.mitre.oval:def:15327 | ||||||||||||
status | accepted | ||||||||||||
submitted | 2012-05-08T13:00:00 | ||||||||||||
title | RTF Mismatch Vulnerability | ||||||||||||
version | 22 |
Seebug
bulletinFamily exploit description No description provided by source. id SSV:60147 last seen 2017-11-19 modified 2012-05-22 published 2012-05-22 reporter Root source https://www.seebug.org/vuldb/ssvid-60147 title Windows XP Keyboard Layouts Pool Corruption LPE 0day PoC (post-MS12-034) bulletinFamily exploit description BUGTRAQ ID: 53344 CVE ID: CVE-2012-0183 Microsoft Word属于办公软件是微软公司的一个文字处理器应用程序。最初是由Richard Brodie为了运行DOS的IBM计算机而在1983年编写的。 Microsoft Office Word在解析RTF数据时的错误,可被利用破坏内存,以当前用户权限执行任意代码,从而控制用户系统。 0 Microsoft Word 2008 for Mac Microsoft Word 2007 Microsoft Word 2003 Microsoft Word 2001 for Mac 厂商补丁: Microsoft --------- Microsoft已经为此发布了一个安全公告(MS12-029)以及相应补丁: MS12-029:Vulnerability in Microsoft Word Could Allow Remote Code Execution (2680352) 链接:http://www.microsoft.com/technet/security/bulletin/MS12-029.asp id SSV:60111 last seen 2017-11-19 modified 2012-05-09 published 2012-05-09 reporter Root title Microsoft Word RTF数据处理远程内存破坏漏洞(MS12-029)
References
- http://secunia.com/advisories/49111
- http://www.securityfocus.com/bid/53344
- http://www.securitytracker.com/id?1027035
- http://www.us-cert.gov/cas/techalerts/TA12-129A.html
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-029
- https://exchange.xforce.ibmcloud.com/vulnerabilities/75122
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15327