Microsoft Office Excel > DbOrParamQry Record Parsing Vulnerability
Damian Frizza from Core Security Technologies discovered a memory corruption occurs on Microsoft Office Excel 2002 when parsing a .XLS file with a malformed DbOrParamQry record. This vulnerability could be used by a remote attacker to execute arbitrary code in the context of the currently logged on user, by enticing the user to open a specially crafted file.
Vulnerability Informations:
Class: Buffer overflow [CWE-119]
Impact: Code execution
Remotely Exploitable: Yes (client-side)
Locally Exploitable: No
Bugtraq ID: N/A
CVE Name: CVE-2010-0264
Affected Packages:
Microsoft Excel 2002 (Office XP SP3)
Proof of Concept:
According to the MSDN documentation the DbOrParamQry record specifies a DbQuery or ParamQry record depending on the preceding record. The Record Query Parameters (ParamQry) offset DCh, contains information about ODBC parameterized queries. This record has the following format:
1 2 3 | Offset Name Size Contents 4 wTypeSql 2 Used for ODBC queries; the parameter SQL type 6 flags 2 Option flags |
By modifying this record an exploitable condition can be triggered. An excerpt of the vulnerable code follows:
1 2 3 4 5 6 7 8 9 10 11 12 13 | EXCEL!Ordinal41+2c20ce: 302c20ce 8b461c mov eax,[esi+0x1c] ds:0023:0180aa98=0197013c 302c20d1 85c0 test eax,eax 302c20d3 0f84e1000000 je EXCEL!Ordinal41+0x2c21ba (302c21ba) [br=0] 302c20d9 8b08 mov ecx,[eax] ds:0023:0197013c=00010001 302c20db 50 push eax 302c20dc ff5108 call dword ptr [ecx+0x8] ds:0023:00010009=5c003a00 Access violation - code c0000005 (first chance) eax=0197013c ebx=00000001 ecx=00010001 edx=0000014c esi=0180aa7c edi=00000000 eip=5c003a00 esp=001363ec ebp=00136400 iopl=0 nv up ei pl nz na po nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000206 5c003a00 ?? ??? |
Vendors:
Microsoft Security Bulletin MS10-017
MSDN DbOrParamQry entry
References:
Core Security Technologies
