CVE-2010-0033
published 2010-02-10CVE-2010-0033: Stack-based buffer overflow in Microsoft Office PowerPoint 2003 SP3 allows remote attackers to execute arbitrary code via a crafted PowerPoint document, aka…
PriorityP264critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
51.07%
98.9th percentile
Stack-based buffer overflow in Microsoft Office PowerPoint 2003 SP3 allows remote attackers to execute arbitrary code via a crafted PowerPoint document, aka "PowerPoint Viewer TextBytesAtom Record Stack Overflow Vulnerability."
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | powerpoint | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- ·The exploit only works on Windows Vista and later; attempting exploitation on Windows XP or earlier will not reach the vulnerable code path. ↗
- ·The pop/pop/ret gadget addresses are hardcoded per PPTVIEW.exe patch level; the ASLR-affected gdiplus.dll target was explicitly commented out as unreliable. ↗
- ·Affected products are PowerPoint Viewer distributed with Office 2003 SP3 and earlier, and Office 2004 for Mac. ↗
CVSS provenance
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vendor_redhat5.5MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-w6h2-rg9q-p285: Stack-based buffer overflow in Microsoft Office PowerPoint 2003 SP3 allows remote attackers to execute arbitrary code via a crafted PowerPoint documen
ghsa_unreviewed·2022-05-02
CVE-2010-0033 [HIGH] CWE-119 GHSA-w6h2-rg9q-p285: Stack-based buffer overflow in Microsoft Office PowerPoint 2003 SP3 allows remote attackers to execute arbitrary code via a crafted PowerPoint documen
Stack-based buffer overflow in Microsoft Office PowerPoint 2003 SP3 allows remote attackers to execute arbitrary code via a crafted PowerPoint document, aka "PowerPoint Viewer TextBytesAtom Record Stack Overflow Vulnerability."
Red Hat
kernel: x86/bugs: Use code segment selector for VERW operand
vendor_redhat·2024-10-29·CVSS 5.5
CVE-2024-50072 [MEDIUM] CWE-20 kernel: x86/bugs: Use code segment selector for VERW operand
kernel: x86/bugs: Use code segment selector for VERW operand
In the Linux kernel, the following vulnerability has been resolved:
x86/bugs: Use code segment selector for VERW operand
Robert Gill reported below #GP in 32-bit mode when dosemu software was
executing vm86() system call:
general protection fault: 0000 [#1] PREEMPT SMP
CPU: 4 PID: 4610 Comm: dosemu.bin Not tainted 6.6.21-gentoo-x86 #1
Hardware name: Dell Inc. PowerEdge 1950/0H723K, BIOS 2.7.0 10/30/2010
EIP: restore_all_switch_stack+0xbe/0xcf
EAX: 00000000 EBX: 00000000 ECX: 00000000 EDX: 00000000
ESI: 00000000 EDI: 00000000 EBP: 00000000 ESP: ff8affdc
DS: 0000 ES: 0000 FS: 0000 GS: 0033 SS: 0068 EFLAGS: 00010046
CR0: 80050033 CR2: 00c2101c CR3: 04b6d000 CR4: 000406d0
Call Trace:
show_regs+0x70/0x78
die_addr+0x29/0x70
exc_genera
Suricata
GPL RPC portmap cachefsd request TCP
suricata·2010-09-23
CVE-2002-0033 GPL RPC portmap cachefsd request TCP
GPL RPC portmap cachefsd request TCP
Rule: alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"GPL RPC portmap cachefsd request TCP"; flow:established,to_server; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 87 8B|"; within:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,4674; reference:cve,2002-0033; reference:cve,2002-0084; classtype:rpc-portmap-decode; sid:2101747; rev:13; metadata:created_at 2010_09_23, cve CVE_2002_0033, signature_severity Informational, updated_at 2024_03_08;)
Suricata
GPL RPC portmap cachefsd request UDP
suricata·2010-09-23
CVE-2002-0033 GPL RPC portmap cachefsd request UDP
GPL RPC portmap cachefsd request UDP
Rule: alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"GPL RPC portmap cachefsd request UDP"; content:"|00 01 86 A0|"; depth:4; offset:12; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 87 8B|"; within:4; content:"|00 00 00 00|"; depth:4; offset:4; reference:bugtraq,4674; reference:cve,2002-0033; reference:cve,2002-0084; classtype:rpc-portmap-decode; sid:2101746; rev:12; metadata:created_at 2010_09_23, cve CVE_2002_0033, signature_severity Informational, updated_at 2019_07_26;)
Exploit-DB
Microsoft PowerPoint Viewer - TextBytesAtom Stack Buffer Overflow (MS10-004) (Metasploit)
exploitdb·2010-09-25
CVE-2010-0033 Microsoft PowerPoint Viewer - TextBytesAtom Stack Buffer Overflow (MS10-004) (Metasploit)
Microsoft PowerPoint Viewer - TextBytesAtom Stack Buffer Overflow (MS10-004) (Metasploit)
---
##
# $Id: ms10_004_textbytesatom.rb 10477 2010-09-25 11:59:02Z mc $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
require 'rex/ole'
class Metasploit3 'Microsoft PowerPoint Viewer TextBytesAtom Stack Buffer Overflow',
'Description' => %q{
This module exploits a stack buffer overflow vulnerability in the handling of
the TextBytesAtom records by Microsoft PowerPoint Viewer. According to Microsoft,
the PowerPoint Viewer distributed with Office 2003 SP3 and earlier, as
Metasploit
MS10-004 Microsoft PowerPoint Viewer TextBytesAtom Stack Buffer Overflow
metasploit
MS10-004 Microsoft PowerPoint Viewer TextBytesAtom Stack Buffer Overflow
MS10-004 Microsoft PowerPoint Viewer TextBytesAtom Stack Buffer Overflow
This module exploits a stack buffer overflow vulnerability in the handling of the TextBytesAtom records by Microsoft PowerPoint Viewer. According to Microsoft, the PowerPoint Viewer distributed with Office 2003 SP3 and earlier, as well as Office 2004 for Mac, are vulnerable. NOTE: The vulnerable code path is not reachable on versions of Windows prior to Windows Vista.
No writeups or analysis indexed.
http://www.securitytracker.com/id?1023563http://www.us-cert.gov/cas/techalerts/TA10-040A.htmlhttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-004https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7711http://www.securitytracker.com/id?1023563http://www.us-cert.gov/cas/techalerts/TA10-040A.htmlhttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-004https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7711
2010-02-10
Published