|
|
Dear List,
I'm writing on behalf of the Check Point Vulnerability Discovery Team to publish the following vulnerability.
Check Point Software Technologies - Vulnerability Discovery Team (VDT)
http://www.checkpoint.com/defense/
Microsoft Office Word HTML Linked Objects Memory Corruption Vulnerability
CVE-2010-1903 - MS10-056
INTRODUCTION
There exists a vulnerability within the way Word handles html linked objects, which leads
to attacker controlled memory write and code execution.
There is a poc.doc file that demonstrates the vulnerability and is available to interested
parts.
This problem was confirmed in the following versions of Word and Windows, other versions
may be also affected.
Microsoft Office XP Service Pack 3 and older
Microsoft Office 2003 Service Pack 3 and older
2007 Microsoft Office System Service Pack 2 and older
Microsoft Office 2004 for Mac
Microsoft Office 2008 for Mac
Open XML file format converter for Mac
Microsoft Office Word Viewer
Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Service Pack 2
Microsoft Works 9
CVSS Scoring System
The CVSS score is: 8.6
Base Score: 10
Temporal Score: 8.6
We used the following values to calculate the scores:
Base score is: AV:N/AC:L/Au:N/C:C/I:C/A:C
Temporal score is: E:POC/RL:U/RC:UR
=09
TRIGGERING THE PROBLEM
The problem is triggered by a PoC available only to interested parts which causes invalid memory write in
all the referred versions.
DETAILS
Opening the attached poc.doc file and breaking in the following call, we see:
eax=00126c5c ebx=00126c40 ecx=00000000 edx=00000001 esi=00944001 edi=00000000
eip=3179fd74 esp=00126b9c ebp=00126bc0 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
wwlib!DllGetClassObject+0x7fe9e:
3179fd74 e87bf9ffff call wwlib!DllGetClassObject+0x7f81e (3179f6f4)
Disassembling the code:
0:000> u
wwlib!DllGetClassObject+0x7fe9e:
3179fd74 e87bf9ffff call wwlib!DllGetClassObject+0x7f81e (3179f6f4)
3179fd79 3bf7 cmp esi,edi
3179fd7b 8b4310 mov eax,dword ptr [ebx+10h]
3179fd7e 894508 mov dword ptr [ebp+8],eax
3179fd81 7404 je wwlib!DllGetClassObject+0x7feb1 (3179fd87)
3179fd83 66893c46 mov word ptr [esi+eax*2],di
3179fd87 397b2c cmp dword ptr [ebx+2Ch],edi
3179fd8a 740e je wwlib!DllGetClassObject+0x7fec4 (3179fd9a)
The faulting instruction is at address 3179fd83, where di and eax are NULL and esi a
fixed value. The value eax is copied from the stack. The same with the di register.
Stepping into the first called function:
0:000> u 3179f6f4
wwlib!DllGetClassObject+0x7f81e:
3179f6f4 55 push ebp
3179f6f5 8bec mov ebp,esp
3179f6f7 81ecb8010000 sub esp,offset