Microsoft Word HTML Linked Object Remote Memory Corruption Vulnerability

Bugtraq ID:	42130
Class:	Boundary Condition Error
CVE:	CVE-2010-1903
Remote:	Yes
Local:	No
Published:	Aug 10 2010 12:00AM
Updated:	Aug 11 2010 08:04PM
Credit:	Rodrigo Rubira Branco of the Check Point IPS Research Team
Vulnerable:	Microsoft Word 2003 SP3 Microsoft Word 2003 SP2 + Microsoft Office 2003 SP1 + Microsoft Office 2003 SP1 + Microsoft Office 2003 0 + Microsoft Office 2003 0 Microsoft Word 2003 SP1 + Microsoft Office 2003 SP1 + Microsoft Office 2003 SP1 + Microsoft Office 2003 0 + Microsoft Office 2003 0 Microsoft Word 2002 SP3 Microsoft Word 2002 SP2 + Microsoft Office XP SP2 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional Microsoft Word 2002 SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Terminal Server 4.0 SP6 - Microsoft Windows NT Terminal Server 4.0 SP5 - Microsoft Windows NT Terminal Server 4.0 SP4 - Microsoft Windows NT Terminal Server 4.0 SP3 - Microsoft Windows NT Terminal Server 4.0 SP2 - Microsoft Windows NT Terminal Server 4.0 SP1 - Microsoft Windows NT Terminal Server 4.0 alpha - Microsoft Windows NT Terminal Server 4.0 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional
Not Vulnerable:

Microsoft Word HTML Linked Object Remote Memory Corruption Vulnerability

Microsoft Word is prone to a remote memory-corruption vulnerability because it fails to properly allocate heap-based memory.

An attacker can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely result in denial-of-service conditions.

Microsoft Word HTML Linked Object Remote Memory Corruption Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Microsoft Word HTML Linked Object Remote Memory Corruption Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the referenced advisory for details.


Microsoft Word 2003 SP3

• Microsoft Security Update for Microsoft Office Word 2003 (KB2251399)
  http://www.microsoft.com/downloads/details.aspx?familyid=4360bcec-0731 -4d4a-89eb-7d28a4607f06

Microsoft Word 2002 SP3

• Microsoft Security Update for Microsoft Word 2002 (KB2251389)
  http://www.microsoft.com/downloads/details.aspx?familyid=978eb887-25b6 -4dde-a2ec-d2d1e7f1a434

Microsoft Word HTML Linked Object Remote Memory Corruption Vulnerability

References:

• Microsoft Office Word HTML Linked Objects Memory Corruption Vulnerability - CVE- (Full Disclosure)
  
• Microsoft Word Homepage (Microsoft )
  
• ZDI-10-151: Microsoft Office Word 2007 plcffldMom Parsing Remote Code Execution (ZDI Disclosures )
  
• Microsoft Security Bulletin MS10-056 (Microsoft)
  
• ZDI-10-151 Microsoft Office Word 2007 plcffldMom Parsing Remote Code Execution V (Zero Day Initiative)