PT-2010-4111 · Microsoft · Windows Xp+3

Publicado 2010-09-15 · Atualizado 2019-02-26 · CVE-2010-2563

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows XP SP2 and SP3 Microsoft Server 2003 SP2

Description A remote code execution issue exists due to improper parsing of malformed structures in Word 97 documents by the Word 97 text converter in Microsoft WordPad. This allows remote attackers to execute arbitrary code via a crafted document. The issue arises when a user opens a specially crafted Word file containing a malformed structure.

Recommendations For Microsoft Windows XP SP2 and SP3, update the WordPad Text Converters to a version that properly handles Word 97 documents. For Microsoft Server 2003 SP2, apply the necessary patch to fix the memory corruption issue in the WordPad Word 97 Text Converter.

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2010-2563

Produtos afetados

Server 2003

Windows Xp

Wordpad

Windows

Referências · 6

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-067 · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6632 · Nota
• https://docs.microsoft.com/security-updates/securitybulletins/2010/MS10-067 · Nota
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=879 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2563 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2010-2563 · Nota de Segurança