Vulnerabilities > CVE-2013-1319 - Remote Code Execution vulnerability in Microsoft Publisher 2003

047910
CVSS 10.0 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
low complexity
microsoft
critical
nessus

Summary

Microsoft Publisher 2003 SP3 does not properly check the return value of an unspecified method, which allows remote attackers to execute arbitrary code via a crafted Publisher file, aka "Publisher Return Value Handling Vulnerability."

Vulnerable Configurations

Part Description Count
Application
Microsoft
1

Msbulletin

bulletin_idMS13-042
bulletin_url
date2013-05-14T00:00:00
impactRemote Code Execution
knowledgebase_id2830397
knowledgebase_url
severityImportant
titleVulnerabilities in Microsoft Publisher Could Allow Remote Code Execution

Nessus

NASL familyWindows : Microsoft Bulletins
NASL idSMB_NT_MS13-042.NASL
descriptionThe Publisher component of Microsoft Office installed on the remote host is affected by multiple vulnerabilities : - The application has a negative value allocation vulnerability. (CVE-2013-1316) - The application has an integer overflow vulnerability. (CVE-2013-1317) - The application has a corrupt interface pointer vulnerability. (CVE-2013-1318) - The application has a return value handling vulnerability. (CVE-2013-1319) - The application has a buffer overflow vulnerability. (CVE-2013-1320) - The application has a return value validation vulnerability. (CVE-2013-1321) - The application has an invalid range check vulnerability. (CVE-2013-1322) - The application has an incorrect NULL value handling vulnerability. (CVE-2013-1323) - The application has a signed integer vulnerability. (CVE-2013-1327) - The application has a pointer handling vulnerability. (CVE-2013-1328) - The application has a buffer underflow vulnerability. (CVE-2013-1329) A remote attacker could exploit these by tricking a user into opening a specially crafted Publisher file, resulting in remote code execution.
last seen2020-06-01
modified2020-06-02
plugin id66417
published2013-05-15
reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
sourcehttps://www.tenable.com/plugins/nessus/66417
titleMS13-042: Vulnerabilities in Microsoft Publisher Could Allow Remote Code Execution (2830397)
code
#
# (C) Tenable Network Security, Inc.
#


include("compat.inc");


if (description)
{
  script_id(66417);
  script_version("1.10");
  script_cvs_date("Date: 2019/11/27");

  script_cve_id(
    "CVE-2013-1316",
    "CVE-2013-1317",
    "CVE-2013-1318",
    "CVE-2013-1319",
    "CVE-2013-1320",
    "CVE-2013-1321",
    "CVE-2013-1322",
    "CVE-2013-1323",
    "CVE-2013-1327",
    "CVE-2013-1328",
    "CVE-2013-1329"
  );
  script_bugtraq_id(
    58771,
    59761,
    59762,
    59763,
    59764,
    59766,
    59767,
    59768,
    59769,
    59770,
    59772
  );
  script_xref(name:"MSFT", value:"MS13-042");
  script_xref(name:"MSKB", value:"2810047");
  script_xref(name:"MSKB", value:"2597971");
  script_xref(name:"MSKB", value:"2553147");

  script_name(english:"MS13-042: Vulnerabilities in Microsoft Publisher Could Allow Remote Code Execution (2830397)");
  script_summary(english:"Checks the version of Publisher");

  script_set_attribute(attribute:"synopsis", value:
"Microsoft Publisher, a component of Microsoft Office installed on the
remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The Publisher component of Microsoft Office installed on the remote
host is affected by multiple vulnerabilities :

  - The application has a negative value allocation
    vulnerability. (CVE-2013-1316)

  - The application has an integer overflow vulnerability.
    (CVE-2013-1317)

  - The application has a corrupt interface pointer
    vulnerability. (CVE-2013-1318)

  - The application has a return value handling
    vulnerability. (CVE-2013-1319)

  - The application has a buffer overflow vulnerability.
    (CVE-2013-1320)

  - The application has a return value validation
    vulnerability. (CVE-2013-1321)

  - The application has an invalid range check
    vulnerability. (CVE-2013-1322)

  - The application has an incorrect NULL value handling
    vulnerability. (CVE-2013-1323)

  - The application has a signed integer vulnerability.
    (CVE-2013-1327)

  - The application has a pointer handling vulnerability.
    (CVE-2013-1328)

  - The application has a buffer underflow vulnerability.
    (CVE-2013-1329)

A remote attacker could exploit these by tricking a user into opening
a specially crafted Publisher file, resulting in remote code
execution.");
  script_set_attribute(attribute:"see_also", value:"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2013/ms13-042");
  script_set_attribute(attribute:"solution", value:
"Microsoft has released a set of patches for Microsoft Publisher 2003
SP3, 2007 SP3, and 2010 SP1.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2013-1322");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2013/05/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2013/05/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2013/05/15");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:office");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows : Microsoft Bulletins");

  script_copyright(english:"This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("smb_hotfixes.nasl", "office_installed.nasl", "ms_bulletin_checks_possible.nasl");
  script_require_keys("SMB/MS_Bulletin_Checks/Possible");
  script_require_ports(139, 445, "Host/patch_management_checks");

  exit(0);
}

include("audit.inc");
include("smb_func.inc");
include("smb_hotfixes.inc");
include("smb_hotfixes_fcheck.inc");
include("misc_func.inc");

get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");

bulletin = 'MS13-042';
kbs = make_list("2810047", "2597971", "2553147");
if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);

installs = get_kb_list_or_exit("SMB/Office/Publisher/*/ProductPath");
vuln = FALSE;
foreach install (keys(installs))
{
  version = install - 'SMB/Office/Publisher/' - '/ProductPath';
  path = installs[install];
  if (isnull(path)) path = 'n/a';

  v = split(version, sep:'.', keep:FALSE);
  for (i = 0; i < max_index(v); i++)
    v[i] = int(v[i]);

  kb = "";
  # Office 2003 SP3
  if (v[0] == 11 && v[1] == 0 && (v[2] >= 8166 && v[2] < 8402))
  {
    office_sp = get_kb_item("SMB/Office/2003/SP");
    if (!isnull(office_sp) && office_sp == 3)
    {
      vuln = TRUE;
      info = '\n  Product           : Publisher 2003'+
             '\n  File              : '+path+
             '\n  Installed version : '+version+
             '\n  Fixed version     : 11.0.8402.0\n';
      kb = "2810047";
    }
  }
  # Office 2007 SP3
  else if (v[0] == 12 && v[1] == 0 &&
           ((v[2] > 6606 || (v[2] == 6606 && v[3] >= 1000)) &&
            (v[2] < 6676 || (v[2] == 6676 && v[3] < 5000))))
  {
    office_sp = get_kb_item("SMB/Office/2007/SP");
    if(!isnull(office_sp) && (office_sp == 3))
    {
      vuln = TRUE;
      info = '\n  Product           : Publisher 2007'+
             '\n  File              : '+path+
             '\n  Installed version : '+version+
             '\n  Fixed version     : 12.0.6676.5000\n';
      kb = "2597971";
    }
  }
  # Office 2010 SP1
  else if (v[0] == 14 && v[1] == 0 &&
           ((v[2] > 6026 || (v[2] == 6026 && v[3] >= 1000)) &&
           (v[2] < 6137 || (v[2] == 6137 && v[3] < 5000))))
  {
    office_sp = get_kb_item("SMB/Office/2010/SP");
    if (!isnull(office_sp) && office_sp == 1)
    {
      vuln = TRUE;
      info = '\n  Product           : Publisher 2010'+
             '\n  File              : '+path+
             '\n  Installed version : '+version+
             '\n  Fixed version     : 14.0.6137.5000\n';
      kb = "2553147";
    }
  }
}

if (vuln)
{
  set_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);
  hotfix_add_report(info, bulletin:bulletin, kb:kb);
  hotfix_security_hole();
  hotfix_check_fversion_end();

  exit(0);
}
else
{
  hotfix_check_fversion_end();
  audit(AUDIT_HOST_NOT, 'affected');
}

Oval

accepted2014-08-18T04:01:47.135-04:00
classvulnerability
contributors
  • nameSecPod Team
    organizationSecPod Technologies
  • nameMaria Kedovskaya
    organizationALTX-SOFT
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
definition_extensions
commentMicrosoft Publisher 2003 SP3 is installed
ovaloval:org.mitre.oval:def:16382
descriptionMicrosoft Publisher 2003 SP3 does not properly check the return value of an unspecified method, which allows remote attackers to execute arbitrary code via a crafted Publisher file, aka "Publisher Return Value Handling Vulnerability."
familywindows
idoval:org.mitre.oval:def:16749
statusaccepted
submitted2013-05-17T11:17:16
titleReturn value handling vulnerability in Microsoft Publisher - MS13-042
version12