PT-2013-5354 · Microsoft · Internet Explorer+4

Published 2013-12-10 · Updated 2018-10-12 · CVE-2013-5057

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Office 2007 SP3 Microsoft Office 2010 SP1 Microsoft Office 2010 SP2

Description A security issue exists due to the lack of Address Space Layout Randomization (ASLR) protection, making it easier for attackers to execute arbitrary code. This is achieved via a crafted COM component on a visited web site with Internet Explorer. The issue has been exploited in the wild. ASLR is a security feature that randomizes the location of executable code in memory to prevent attackers from predicting where their malicious code will be loaded. Without ASLR, attackers can more easily predict where their code will be loaded, making it easier to exploit vulnerabilities.

Recommendations For Microsoft Office 2007 SP3, update to a version that implements the ASLR protection mechanism. For Microsoft Office 2010 SP1, update to a version that implements the ASLR protection mechanism. For Microsoft Office 2010 SP2, update to a version that implements the ASLR protection mechanism.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2013-5057

Affected Products

Internet Explorer

Office 2007 Sp3

Office 2010 Sp1

Office 2010 Sp2

Office

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2013-5057 · Security Note
• http://blogs.technet.com/b/srd/archive/2013/12/09/ms13-106-another-aslr-bypass-is-gone.aspx · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5057 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-106 · Vendor Advisory
• http://technet.microsoft.com/en-us/security/bulletin/ms13-106 · Note