PT-2013-4752 · Microsoft · Wordpad+1

Hossein Lotfi · Publicado 2013-11-12 · Atualizado 2019-05-14 · CVE-2013-3940

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the fixed version

Description The issue is related to an integer overflow in the Graphics Device Interface (GDI) that allows remote attackers to execute arbitrary code or cause a denial of service via a crafted image in a Windows Write (.wri) document. This document is not properly handled in WordPad. An attacker who successfully exploits this issue could take complete control of an affected system, allowing them to install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Microsoft Windows versions prior to the fixed version, update to the latest version to resolve the issue. As a temporary workaround, consider restricting the use of WordPad to minimize the risk of exploitation.

Correção

RCE

DoS

Integer Overflow

Enumeração de Fraquezas

CWE-190

Identificadores relacionados

CVE-2013-3940

Produtos afetados

Windows

Wordpad

Referências · 6

• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18722 · Nota
• http://technet.microsoft.com/en-us/security/bulletin/ms13-089 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-089 · Aviso do Fabricante
• http://us-cert.gov/ncas/alerts/TA13-317A · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-3940 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3940 · Nota de Segurança