Microsoft Visual Basic for Applications CVE-2012-1854 DLL Loading Code Execution Vulnerability

Bugtraq ID:	53830
Class:	Design Error
CVE:	CVE-2012-1854
Remote:	Yes
Local:	No
Published:	Jun 12 2012 12:00AM
Updated:	Jun 12 2012 12:00AM
Credit:	Bai Haowen of Huawei Security Labs
Vulnerable:	Microsoft Visual Basic for Applications SDK 6.4 Microsoft Visual Basic for Applications SDK 6.3 Microsoft Visual Basic for Applications SDK 6.2 Microsoft Visual Basic for Applications SDK 6.0 Microsoft Visual Basic for Applications SDK 5.0 Microsoft Visual Basic for Applications 6.3 .9402 - Microsoft Windows NT 4.0 Microsoft Visual Basic for Applications 0 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 Microsoft Office 2007 SP3 Microsoft Office 2007 SP2 Microsoft Office 2007 SP1 Microsoft Office 2007 0 + Microsoft Access 2007 0 + Microsoft Access 2007 0 + Microsoft Excel 2003 + Microsoft Excel 2007 0 + Microsoft Excel 2007 0 + Microsoft FrontPage 2003 + Microsoft Groove 2007 0 + Microsoft Groove 2007 0 + Microsoft InfoPath 2003 + Microsoft InfoPath 2007 0 + Microsoft InfoPath 2007 0 + Microsoft Office Communicator 2007 0 + Microsoft Office Communicator 2007 0 + Microsoft OneNote 2003 0 + Microsoft Outlook 2003 0 + Microsoft Outlook 2007 0 + Microsoft Outlook 2007 0 + Microsoft PowerPoint 2003 0 + Microsoft PowerPoint 2007 0 + Microsoft PowerPoint 2007 0 + Microsoft Project Professional 2007 0 + Microsoft Project Professional 2007 0 + Microsoft Project Standard 2007 0 + Microsoft Project Standard 2007 0 + Microsoft Publisher 2003 + Microsoft Publisher 2007 0 + Microsoft Publisher 2007 0 + Microsoft SharePoint Designer 2007 0 + Microsoft SharePoint Designer 2007 0 + Microsoft Visio Professional 2007 0 + Microsoft Visio Professional 2007 0 + Microsoft Visio Standard 2007 0 + Microsoft Visio Standard 2007 0 Microsoft Office 2003 SP3 Microsoft Office 2003 SP2 Microsoft Office 2003 SP1
Not Vulnerable:

RETIRED: Microsoft Visual Basic for Applications DLL Loading Arbitrary Code Execution Vulnerability

Microsoft Visual Basic for Applications is prone to a vulnerability that lets attackers execute arbitrary code.

An attacker can exploit this issue by enticing a legitimate user to use the vulnerable application to open a file from a network share location which contains a specially crafted Dynamic Link Library (DLL) file.

Successful exploits will compromise the application in the context of the currently logged-in user.

NOTE: This BID is being retired as a duplicate of BID 54303 (Microsoft Visual Basic for Applications DLL Loading Arbitrary Code Execution Vulnerability).

Microsoft Visual Basic for Applications CVE-2012-1854 DLL Loading Code Execution Vulnerability

A general exploit technique has been documented by TheLeader and H.D. Moore for the Metasploit Project; please see the references for more information.

RETIRED: Microsoft Visual Basic for Applications DLL Loading Arbitrary Code Execution Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for details.

RETIRED: Microsoft Visual Basic for Applications DLL Loading Arbitrary Code Execution Vulnerability

References:

• Application DLL Load Hijacking (HD Moore)
  
• Exploiting DLL Hijacking Flaws (hdm)
  
• Microsoft Homepage (Microsoft)
  
• More information about the DLL Preloading remote attack vector (Microsoft)