Vulnerabilities > CVE-2012-0183 - RTF Data Handling Remote Memory Corruption vulnerability in Microsoft Office, Office Compatibility Pack and Word

047910
CVSS 9.3 - CRITICAL
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
microsoft
critical
nessus

Summary

Microsoft Word 2003 SP3 and 2007 SP2 and SP3, Office 2008 and 2011 for Mac, and Office Compatibility Pack SP2 and SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted RTF data, aka "RTF Mismatch Vulnerability."

Vulnerable Configurations

Part Description Count
Application
Microsoft
6

Msbulletin

bulletin_idMS12-029
bulletin_url
date2012-05-08T00:00:00
impactRemote Code Execution
knowledgebase_id2680352
knowledgebase_url
severityCritical
titleVulnerability in Microsoft Word Could Allow Remote Code Execution

Nessus

  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS12-029.NASL
    descriptionThe version of Office and/or Office Compatibility Pack installed on the remote host has a memory corruption vulnerability. A remote attacker could exploit this by tricking a user into opening a specially crafted RTF file, resulting in arbitrary code execution.
    last seen2020-06-01
    modified2020-06-02
    plugin id59037
    published2012-05-09
    reporterThis script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/59037
    titleMS12-029: Vulnerability in Microsoft Word Could Allow Remote Code Execution (2680352)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(59037);
      script_version("1.21");
      script_cvs_date("Date: 2018/11/15 20:50:31");
    
      script_cve_id("CVE-2012-0183");
      script_bugtraq_id(53344);
      script_xref(name:"MSFT", value:"MS12-029");
      script_xref(name:"MSKB", value:"2596880");
      script_xref(name:"MSKB", value:"2596917");
      script_xref(name:"MSKB", value:"2598332");
    
      script_name(english:"MS12-029: Vulnerability in Microsoft Word Could Allow Remote Code Execution (2680352)");
      script_summary(english:"Checks file versions");
    
      script_set_attribute(
        attribute:"synopsis",
        value:
    "A Microsoft Office component installed on the remote host has a memory
    corruption vulnerability."
      );
      script_set_attribute(
        attribute:"description",
        value:
    "The version of Office and/or Office Compatibility Pack installed on
    the remote host has a memory corruption vulnerability.  A remote
    attacker could exploit this by tricking a user into opening a
    specially crafted RTF file, resulting in arbitrary code execution."
      );
      script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-12-186/");
      script_set_attribute(attribute:"see_also", value:"https://seclists.org/fulldisclosure/2012/Nov/112");
      script_set_attribute(attribute:"see_also", value:"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2012/ms12-029");
      script_set_attribute(
        attribute:"solution",
        value:
    "Microsoft has released a set of patches for Office 2003, 2007, and
    Office Compatibility Pack."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/05/08");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/05/08");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/05/09");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:office");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:word");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:office_compatibility_pack");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows : Microsoft Bulletins");
    
      script_copyright(english:"This script is Copyright (C) 2012-2018 Tenable Network Security, Inc.");
    
      script_dependencies("smb_nt_ms02-031.nasl", "office_installed.nasl", "smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
      script_require_keys("SMB/MS_Bulletin_Checks/Possible");
      script_require_ports(139, 445, "Host/patch_management_checks");
    
      exit(0);
    }
    
    include("smb_func.inc");
    include("smb_hotfixes.inc");
    include("smb_hotfixes_fcheck.inc");
    include("misc_func.inc");
    include("audit.inc");
    
    get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");
    
    bulletin = 'MS12-029';
    kbs = make_list('2596880', '2596917', '2598332');
    if (get_kb_item("Host/patch_management_checks"))
      hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);
    
    kb = "";
    vuln = FALSE;
    # Word.
    installs = get_kb_list("SMB/Office/Word/*/ProductPath");
    if (!isnull(installs))
    {
      foreach install (keys(installs))
      {
        info = "";
        version = install - 'SMB/Office/Word/' - '/ProductPath';
        path = installs[install];
        if (isnull(path)) path = 'n/a';
    
        ver = split(version, sep:'.', keep:FALSE);
        for (i=0; i<max_index(ver); i++)
        ver[i] = int(ver[i]);
    
        # Word 2007
        office_sp = get_kb_item("SMB/Office/2007/SP");
        if (
          (!isnull(office_sp) && (office_sp == 2 || office_sp == 3)) &&
          (
            ver[0] == 12 && ver[1] == 0 &&
            (
              ver[2] < 6661 ||
              (ver[2] == 6661 && ver[3] < 5000)
            )
          )
        )
        {
          info =
            '\n  Product           : Word 2007' +
            '\n  File              : ' + path +
            '\n  Installed version : ' + version +
            '\n  Fixed version     : 12.0.6661.5000' + '\n';
          kb = "2596917";
        }
    
        # Word 2003
        office_sp = get_kb_item("SMB/Office/2003/SP");
        if ((!isnull(office_sp) && (office_sp == 3)) && (ver[0] == 11 && ver[1] == 0 && ver[2] < 8345))
        {
            info =
              '\n  Product           : Word 2003' +
              '\n  File              : ' + path +
              '\n  Installed version : ' + version +
              '\n  Fixed version     : 11.0.8345.0' + '\n';
            kb = "2598332";
        }
    
        if (info)
        {
          hotfix_add_report(info, bulletin:bulletin, kb:kb);
          vuln = TRUE;
        }
      }
    }
    
    # 2007 Microsoft Office system and the Microsoft Office Compatibility Pack.
    installs = get_kb_list("SMB/Office/WordCnv/*/ProductPath");
    if (!isnull(installs))
    {
      foreach install (keys(installs))
      {
        version = install - 'SMB/Office/WordCnv/' - '/ProductPath';
        path = installs[install];
    
        if (path)
        {
          share = hotfix_path2share(path:path);
          if (is_accessible_share(share:share))
          {
            path = path - '\\Wordconv.exe';
    
            old_report = hotfix_get_report();
            check_file = "wordcnv.dll";
    
            if (version =~ '^12\\.0' && hotfix_check_fversion(path:path, file:check_file, version:"12.0.6661.5000") == HCF_OLDER)
            {
              file = ereg_replace(pattern:"^[A-Za-z]:(.*)", string:path, replace:"\1\" + check_file);
              kb_name = "SMB/FileVersions/"+tolower(share-'$')+tolower(str_replace(string:file, find:"\", replace:"/"));
              version = get_kb_item(kb_name);
    
              info =
                '\n  Product           : Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats' +
                '\n  File              : ' + path + '\\' + check_file +
                '\n  Installed version : ' + version +
                '\n  Fixed version     : 12.0.6661.5000' + '\n';
    
              hcf_report = '';
             hotfix_add_report(old_report + info, bulletin:bulletin, kb:"2596880");
              vuln = TRUE;
            }
          }
        }
      }
      hotfix_check_fversion_end();
    }
    
    if (vuln)
    {
      set_kb_item(name:'SMB/Missing/' + bulletin, value:TRUE);
      hotfix_security_hole();
      exit(0);
    }
    else
    {
      audit(AUDIT_HOST_NOT, 'affected');
    }
    
    
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_MS_OFFICE_MAY2012.NASL
    descriptionThe remote Mac OS X host is running a version of Microsoft Office that is affected by the following vulnerabilities : - A memory corruption vulnerability could be triggered when parsing specially crafted RTF-formatted data. (CVE-2012-0183) - Several memory corruption vulnerabilities could be triggered when reading a specially crafted Excel file. (CVE-2012-0141 / CVE-2012-0142 / CVE-2012-0143 / CVE-2012-0184) - A record parsing mismatch exists when opening a specially crafted Excel file. (CVE-2012-1847) If a remote attacker can trick a user into opening a malicious file using the affected install, these vulnerabilities could be leveraged to execute arbitrary code subject to the user
    last seen2019-10-28
    modified2012-05-09
    plugin id59046
    published2012-05-09
    reporterThis script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/59046
    titleMS12-029 / MS12-030: Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (2680352 / 2663830) (Mac OS X)
    code
    #TRUSTED 221a39e638e056ce0e8a4e697dd027a317c87115e76eee2216515d932a692995e50d4de42537c8dcac0632360d3ba2286005b9f5461c2823a36a1af2d96637a932573779fd5121d51f936f8b03efa148a601cf701506d0e55b5bdfa629bacbbb92cc0e79d76704be82d855fea363df8b9adee90b54b66c5a2c4bd54a992c931e95a4966b160ae0ff4134a73e0ae5244b4558f56301e0c2511992bd25f4da4a2e0ca5abc374660a5267dfec66d7c788fbcc8705045fdbaf7d2d9d7ed3e8dad8ac1f9ddeae6852c475200c415c9745f990dfdb5831384ac571d18555f2a7093448399000b19d43612348cba3b162c4bd1bddb2c15e0f65802acabdc1553183cfdf76402bebb2ae7fd338c4de0ad5a3a8b6157ed1c19f3ed0b448aabd5c0876fd55c992d0c657a98edaf12c25312dafffb242ab3210dfcf3ca88880b2cf47cdca718bdb2ba91ca963e0fdbdf1978779913b540f9569f43d5ba7191b842fab0be891ecb472851d7832c1a95675fc96ceff9a836337b9872115acd66fa756bd415385901137a8fe637bfa72f84f1792537f437d83ce505fc48fd74912cd9f89ea2dfab3af4f16588f691a952a03320113c26f0bb7caeabb39cbed3a600797a0015a70812f8696d4da6ca682491b7ae5733103b6d9d1025045b190645fbe689b0184aa7e7060f1ee827845fe826b5fb54a8f045508ba1d3d1ac1290f09b222de0b4b2a
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(59046);
      script_version("1.18");
      script_set_attribute(attribute:"plugin_modification_date", value:"2018/07/14");
    
      script_cve_id(
        "CVE-2012-0141",
        "CVE-2012-0142",
        "CVE-2012-0143",
        "CVE-2012-0183",
        "CVE-2012-0184",
        "CVE-2012-1847"
      );
      script_bugtraq_id(53342, 53344, 53373, 53374, 53375, 53379);
      script_xref(name:"MSFT", value:"MS12-029");
      script_xref(name:"MSFT", value:"MS12-030");
      script_xref(name:"MSKB", value:"2665346");
      script_xref(name:"MSKB", value:"2665351");
    
      script_name(english:"MS12-029 / MS12-030: Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (2680352 / 2663830) (Mac OS X)");
      script_summary(english:"Check version of Microsoft Office");
    
      script_set_attribute(attribute:"synopsis", value:
    "An application installed on the remote Mac OS X host is affected by
    multiple remote code execution vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote Mac OS X host is running a version of Microsoft Office that
    is affected by the following vulnerabilities :
    
      - A memory corruption vulnerability could be triggered
        when parsing specially crafted RTF-formatted data.
        (CVE-2012-0183)
    
      - Several memory corruption vulnerabilities could be
        triggered when reading a specially crafted Excel file.
        (CVE-2012-0141 / CVE-2012-0142 / CVE-2012-0143 /
        CVE-2012-0184)
    
      - A record parsing mismatch exists when opening a
        specially crafted Excel file. (CVE-2012-1847)
    
    If a remote attacker can trick a user into opening a malicious file
    using the affected install, these vulnerabilities could be leveraged
    to execute arbitrary code subject to the user's privileges.");
      script_set_attribute(attribute:"see_also", value:"http://www.zerodayinitiative.com/advisories/ZDI-12-157/");
      script_set_attribute(attribute:"see_also", value:"http://seclists.org/fulldisclosure/2012/Aug/279");
      script_set_attribute(attribute:"see_also", value:"http://technet.microsoft.com/en-us/security/bulletin/ms12-029");
      script_set_attribute(attribute:"see_also", value:"http://technet.microsoft.com/en-us/security/bulletin/ms12-030");
      script_set_attribute(attribute:"solution", value:
    "Microsoft has released patches for Office for Mac 2011 and Office 2008
    for Mac.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/05/08");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/05/08");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/05/09");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:office:2008::mac");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:office:2011::mac");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"MacOS X Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2012-2018 Tenable Network Security, Inc.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/MacOSX/Version");
    
      exit(0);
    }
    
    
    include("global_settings.inc");
    include("misc_func.inc");
    include("ssh_func.inc");
    include("macosx_func.inc");
    
    
    
    if(sshlib::get_support_level() >= sshlib::SSH_LIB_SUPPORTS_COMMANDS)
      enable_ssh_wrappers();
    else disable_ssh_wrappers();
    
    if (!get_kb_item("Host/local_checks_enabled")) exit(0, "Local checks are not enabled.");
    
    os = get_kb_item("Host/MacOSX/Version");
    if (!os) exit(0, "The host does not appear to be running Mac OS X.");
    
    
    # Gather version info.
    info = '';
    installs = make_array();
    
    prod = 'Office for Mac 2011';
    plist = "/Applications/Microsoft Office 2011/Office/MicrosoftComponentPlugin.framework/Versions/14/Resources/Info.plist";
    cmd =  'cat \'' + plist + '\' | ' +
      'grep -A 1 CFBundleShortVersionString | ' +
      'tail -n 1 | ' +
      'sed \'s/.*string>\\(.*\\)<\\/string>.*/\\1/g\'';
    version = exec_cmd(cmd:cmd);
    if (version && version =~ "^[0-9]+\.")
    {
      version = chomp(version);
      if (version !~ "^14\.") exit(1, "Failed to get the version for "+prod+" - '"+version+"'.");
    
      installs[prod] = version;
    
      ver = split(version, sep:'.', keep:FALSE);
      for (i=0; i<max_index(ver); i++)
        ver[i] = int(ver[i]);
    
      fixed_version = '14.2.2';
      fix = split(fixed_version, sep:'.', keep:FALSE);
      for (i=0; i<max_index(fix); i++)
        fix[i] = int(fix[i]);
    
      for (i=0; i<max_index(fix); i++)
        if ((ver[i] < fix[i]))
        {
          info +=
            '\n  Product           : ' + prod +
            '\n  Installed version : ' + version +
            '\n  Fixed version     : ' + fixed_version + '\n';
          break;
        }
        else if (ver[i] > fix[i])
          break;
    }
    
    prod = 'Office 2008 for Mac';
    plist = "/Applications/Microsoft Office 2008/Office/MicrosoftComponentPlugin.framework/Versions/12/Resources/Info.plist";
    cmd =  'cat \'' + plist + '\' | ' +
      'grep -A 1 CFBundleShortVersionString | ' +
      'tail -n 1 | ' +
      'sed \'s/.*string>\\(.*\\)<\\/string>.*/\\1/g\'';
    version = exec_cmd(cmd:cmd);
    if (version && version =~ "^[0-9]+\.")
    {
      version = chomp(version);
      if (version !~ "^12\.") exit(1, "Failed to get the version for "+prod+" - '"+version+"'.");
    
      installs[prod] = version;
    
      fixed_version = '12.3.3';
      if (ver_compare(ver:version, fix:fixed_version, strict:FALSE) == -1)
      {
        info +=
          '\n  Product           : ' + prod +
          '\n  Installed version : ' + version +
          '\n  Fixed version     : ' + fixed_version + '\n';
      }
    }
    
    
    # Report findings.
    if (info)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:info);
      else security_hole(0);
    
      exit(0);
    }
    else
    {
      if (max_index(keys(installs)) == 0) exit(0, "Office for Mac is not installed.");
      else
      {
        msg = 'The host has ';
        foreach prod (sort(keys(installs)))
          msg += prod + ' ' + installs[prod] + ' and ';
        msg = substr(msg, 0, strlen(msg)-1-strlen(' and '));
    
        msg += ' installed and thus is not affected.';
    
        exit(0, msg);
      }
    }
    

Oval

accepted2014-06-30T04:05:40.358-04:00
classvulnerability
contributors
  • nameJosh Turpin
    organizationSymantec Corporation
  • nameJosh Turpin
    organizationSymantec Corporation
  • nameMaria Mikhno
    organizationALTX-SOFT
definition_extensions
  • commentMicrosoft Word 2003 is installed
    ovaloval:org.mitre.oval:def:475
  • commentMicrosoft Word 2007 is installed
    ovaloval:org.mitre.oval:def:2074
  • commentMicrosoft Office Compatibility Pack is installed
    ovaloval:org.mitre.oval:def:1853
descriptionMicrosoft Word 2003 SP3 and 2007 SP2 and SP3, Office 2008 and 2011 for Mac, and Office Compatibility Pack SP2 and SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted RTF data, aka "RTF Mismatch Vulnerability."
familywindows
idoval:org.mitre.oval:def:15327
statusaccepted
submitted2012-05-08T13:00:00
titleRTF Mismatch Vulnerability
version22

Seebug

  • bulletinFamilyexploit
    descriptionNo description provided by source.
    idSSV:60147
    last seen2017-11-19
    modified2012-05-22
    published2012-05-22
    reporterRoot
    sourcehttps://www.seebug.org/vuldb/ssvid-60147
    titleWindows XP Keyboard Layouts Pool Corruption LPE 0day PoC (post-MS12-034)
  • bulletinFamilyexploit
    descriptionBUGTRAQ ID: 53344 CVE ID: CVE-2012-0183 Microsoft Word属于办公软件是微软公司的一个文字处理器应用程序。最初是由Richard Brodie为了运行DOS的IBM计算机而在1983年编写的。 Microsoft Office Word在解析RTF数据时的错误,可被利用破坏内存,以当前用户权限执行任意代码,从而控制用户系统。 0 Microsoft Word 2008 for Mac Microsoft Word 2007 Microsoft Word 2003 Microsoft Word 2001 for Mac 厂商补丁: Microsoft --------- Microsoft已经为此发布了一个安全公告(MS12-029)以及相应补丁: MS12-029:Vulnerability in Microsoft Word Could Allow Remote Code Execution (2680352) 链接:http://www.microsoft.com/technet/security/bulletin/MS12-029.asp
    idSSV:60111
    last seen2017-11-19
    modified2012-05-09
    published2012-05-09
    reporterRoot
    titleMicrosoft Word RTF数据处理远程内存破坏漏洞(MS12-029)