Microsoft Access 'AccWizObjects' ActiveX Control Remote Code Execution Vulnerability

Bugtraq ID:	41444
Class:	Unknown
CVE:	CVE-2010-1881
Remote:	Yes
Local:	No
Published:	Jul 13 2010 12:00AM
Updated:	Jul 26 2010 07:45PM
Credit:	Robert Freeman of IBM ISS X-Force
Vulnerable:	Microsoft Access 2003 SP3 + Microsoft Office XP SP2 + Microsoft Office XP SP2 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional - Microsoft Windows XP Professional Microsoft Access 2003 SP2 + Microsoft Office XP SP2 + Microsoft Office XP SP2 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional - Microsoft Windows XP Professional Microsoft Access 2003
Not Vulnerable:

Microsoft Access 'AccWizObjects' ActiveX Control Remote Code Execution Vulnerability

Microsoft Access is prone to a remote code-execution vulnerability that affects the 'AccWizObjects' ActiveX control.

An attacker can exploit this issue by enticing an unsuspecting user to view a malicious webpage.

Successful exploits will allow the attacker to execute arbitrary code within the context of the application, typically Internet Explorer, that uses the ActiveX control.

Microsoft Access 'AccWizObjects' ActiveX Control Remote Code Execution Vulnerability

A working commercial exploit is available through VUPEN Security - Exploit and PoCs Service. This exploit is not otherwise publicly available or known to be circulating in the wild.

Microsoft Access 'AccWizObjects' ActiveX Control Remote Code Execution Vulnerability

Solution:
The vendor has released an advisory and fixes. Please see the references for more information.


Microsoft Access 2003 SP3

• Microsoft Security Update for Microsoft Office Access 2003 (KB981716)
  http://www.microsoft.com/downloads/details.aspx?familyid=93768ac6-e6d7 -4175-a6e3-666210494678

Microsoft Access 'AccWizObjects' ActiveX Control Remote Code Execution Vulnerability

References:

• Microsoft Homepage (Microsoft)
  
• Microsoft Knowledge Base Article 240797 (Microsoft)
  
• Microsoft Security Bulletin MS10-044 (Microsoft)