PT-2013-5354 · Microsoft · Internet Explorer+4

Publicado 2013-12-10 · Atualizado 2018-10-12 · CVE-2013-5057

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Office 2007 SP3 Microsoft Office 2010 SP1 Microsoft Office 2010 SP2

Description A security issue exists due to the lack of Address Space Layout Randomization (ASLR) protection, making it easier for attackers to execute arbitrary code. This is achieved via a crafted COM component on a visited web site with Internet Explorer. The issue has been exploited in the wild. ASLR is a security feature that randomizes the location of executable code in memory to prevent attackers from predicting where their malicious code will be loaded. Without ASLR, attackers can more easily predict where their code will be loaded, making it easier to exploit vulnerabilities.

Recommendations For Microsoft Office 2007 SP3, update to a version that implements the ASLR protection mechanism. For Microsoft Office 2010 SP1, update to a version that implements the ASLR protection mechanism. For Microsoft Office 2010 SP2, update to a version that implements the ASLR protection mechanism.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2013-5057

Produtos afetados

Internet Explorer

Office 2007 Sp3

Office 2010 Sp1

Office 2010 Sp2

Office

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2013-5057 · Nota de Segurança
• http://blogs.technet.com/b/srd/archive/2013/12/09/ms13-106-another-aslr-bypass-is-gone.aspx · Aviso do Fabricante
• http://technet.microsoft.com/en-us/security/bulletin/ms13-106 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5057 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-106 · Aviso do Fabricante