BID:39931

Microsoft Visual Basic for Applications Text Parsing Stack Buffer Overflow Vulnerability

Info

Microsoft Visual Basic for Applications Text Parsing Stack Buffer Overflow Vulnerability

Bugtraq ID:	39931
Class:	Boundary Condition Error
CVE:	CVE-2010-0815
Remote:	Yes
Local:	No
Published:	May 11 2010 12:00AM
Updated:	Mar 22 2011 03:37PM
Credit:	NSFocus Security Team
Vulnerable:	Microsoft Visual Basic for Applications SDK 6.0 Microsoft Visual Basic for Applications 0 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 Microsoft Office XP SP3 + Microsoft Excel 2002 SP3 + Microsoft Excel 2002 SP3 + Microsoft FrontPage 2002 SP3 + Microsoft FrontPage 2002 SP3 + Microsoft Outlook 2002 SP3 + Microsoft Outlook 2002 SP3 + Microsoft PowerPoint 2002 SP3 + Microsoft PowerPoint 2002 SP3 + Microsoft Publisher 2002 SP3 + Microsoft Publisher 2002 SP3 Microsoft Office XP SP2 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional Microsoft Office XP SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional Microsoft Office XP - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional Microsoft Office 2007 SP2 Microsoft Office 2007 SP1 Microsoft Office 2007 0 + Microsoft Access 2007 0 + Microsoft Access 2007 0 + Microsoft Excel 2003 + Microsoft Excel 2007 0 + Microsoft Excel 2007 0 + Microsoft FrontPage 2003 + Microsoft Groove 2007 0 + Microsoft Groove 2007 0 + Microsoft InfoPath 2003 + Microsoft InfoPath 2007 0 + Microsoft InfoPath 2007 0 + Microsoft Office Communicator 2007 0 + Microsoft Office Communicator 2007 0 + Microsoft OneNote 2003 0 + Microsoft Outlook 2003 0 + Microsoft Outlook 2007 0 + Microsoft Outlook 2007 0 + Microsoft PowerPoint 2003 0 + Microsoft PowerPoint 2007 0 + Microsoft PowerPoint 2007 0 + Microsoft Project Professional 2007 0 + Microsoft Project Professional 2007 0 + Microsoft Project Standard 2007 0 + Microsoft Project Standard 2007 0 + Microsoft Publisher 2003 + Microsoft Publisher 2007 0 + Microsoft Publisher 2007 0 + Microsoft SharePoint Designer 2007 0 + Microsoft SharePoint Designer 2007 0 + Microsoft Visio Professional 2007 0 + Microsoft Visio Professional 2007 0 + Microsoft Visio Standard 2007 0 + Microsoft Visio Standard 2007 0 Microsoft Office 2003 SP3 Microsoft Office 2003 SP2 Microsoft Office 2003 SP1 Microsoft Office 2003 0 + Microsoft Excel 2003 + Microsoft FrontPage 2003 + Microsoft InfoPath 2003 + Microsoft OneNote 2003 0 + Microsoft Outlook 2003 0 + Microsoft PowerPoint 2003 0 + Microsoft Publisher 2003 IBM CATIA V5 Release 19 IBM CATIA V5 Release 18 IBM CATIA V5 Release 18

Not Vulnerable:	IBM CATIA V5 Release 21

Discussion

Microsoft Visual Basic for Applications Text Parsing Stack Buffer Overflow Vulnerability

Microsoft Visual Basic for Applications (VBA) is prone to a remote stack-based buffer-overflow vulnerability because of an error related to searching for embedded ActiveX controls within a Microsoft Office document.

An attacker could exploit this issue to corrupt stack memory and execute arbitrary code with the privileges of the currently logged-in user. Failed exploit attempts may crash applications that use VBA.

Exploit / POC

Microsoft Visual Basic for Applications Text Parsing Stack Buffer Overflow Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

A commercial proof of concept is available through VUPEN Security - Exploit and PoCs Service. This proof of concept is not otherwise publicly available or known to be circulating in the wild.

Solution / Fix

Microsoft Visual Basic for Applications Text Parsing Stack Buffer Overflow Vulnerability

Solution:
The vendor has released updates and an advisory. Please see the references for details.

Microsoft Office XP SP3

Microsoft Security Update for Microsoft Office XP (KB976380)
http://www.microsoft.com/downloads/details.aspx?familyid=72c23b0f-4e24 -4334-bc8a-334adc8bc42b

Microsoft Office 2007 SP2

Microsoft Security Update for the 2007 Microsoft Office System (KB976321)
http://www.microsoft.com/downloads/details.aspx?familyid=160ad53e-6475 -4550-90c2-444e4abea730

Microsoft Office 2007 SP1

Microsoft Security Update for the 2007 Microsoft Office System (KB976321)
http://www.microsoft.com/downloads/details.aspx?familyid=160ad53e-6475 -4550-90c2-444e4abea730

Microsoft Office 2003 SP3

Microsoft Security Update for Microsoft Office 2003 (KB976382)
http://www.microsoft.com/downloads/details.aspx?familyid=f8eac9bc-8389 -4ac8-8b29-9a8180d9fd34

References

Microsoft Visual Basic for Applications Text Parsing Stack Buffer Overflow Vulnerability

References:

HE02859: OM : MICROSOFT OFFICE VULNERABILITIES DETECTED WITH VBA CODE INS TALLED (IBM)
Microsoft Homepage (Microsoft)
Microsoft Office Product Homepage (Microsoft)
MS10-031: VBE6 Single-Byte Stack Overwrite (Microsoft)
Microsoft Security Bulletin MS10-031 (Microsoft)