CVE-2010-0256

Microsoft Office Visio 2002 SP2, 2003 SP3, and 2007 SP1 and SP2 does not properly calculate unspecified indexes associated with Visio files, which allows remote attackers to execute arbitrary code via a crafted file, aka "Visio Index Calculation Memory Corruption Vulnerability."

CVSS v2.0 7.6 HIGH

7.6^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:H/Au:N/C:C/I:C/A:C

Exploitability : 4.9 / Impact : 10.0

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.us-cert.gov/cas/techalerts/TA10-103A.html	US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-028
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6732
http://www.us-cert.gov/cas/techalerts/TA10-103A.html	US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-028
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6732

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:microsoft:visio:2002:sp2::::::
	cpe:2.3:a:microsoft:visio:2003:sp3::::::
	cpe:2.3:a:microsoft:visio:2007:sp1::::::
	cpe:2.3:a:microsoft:visio:2007:sp2::::::

History

21 Nov 2024, 01:11

Type	Values Removed	Values Added
References	~~() http://www.us-cert.gov/cas/techalerts/TA10-103A.html - US Government Resource~~	() http://www.us-cert.gov/cas/techalerts/TA10-103A.html - US Government Resource
References	~~() https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-028 -~~	() https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-028 -
References	~~() https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6732 -~~	() https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6732 -

Information

Published : 2010-04-14 16:00

Updated : 2024-11-21 01:11

NVD link : CVE-2010-0256

Mitre link : CVE-2010-0256

CVE.ORG link : CVE-2010-0256

JSON object : View

Products Affected

microsoft

visio

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2010-0256", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.6, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "HIGH", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": true, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2010-04-14T16:00:01.570", "references": [{"url": "http://www.us-cert.gov/cas/techalerts/TA10-103A.html", "tags": ["US Government Resource"], "source": "secure@microsoft.com"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-028", "source": "secure@microsoft.com"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6732", "source": "secure@microsoft.com"}, {"url": "http://www.us-cert.gov/cas/techalerts/TA10-103A.html", "tags": ["US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-028", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6732", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Microsoft Office Visio 2002 SP2, 2003 SP3, and 2007 SP1 and SP2 does not properly calculate unspecified indexes associated with Visio files, which allows remote attackers to execute arbitrary code via a crafted file, aka \"Visio Index Calculation Memory Corruption Vulnerability.\""}, {"lang": "es", "value": "Microsoft Office Visio 2002 SP2, 2003 SP3, y 2007 SP1 y SP2 no calcula adecuadamente \u00edndices no especificado asociados con ficheros Visio, lo que permite a atacantes remotos ejecutar c\u00f3digo de su elecci\u00f3n a trav\u00e9s de un fichero manipulado, conocido como \"Visio Index Calculation Memory Corruption Vulnerability.\""}], "lastModified": "2024-11-21T01:11:51.280", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:visio:2002:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D0D2C5C3-225C-49DC-B9C7-C5BC05900F2E"}, {"criteria": "cpe:2.3:a:microsoft:visio:2003:sp3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "553ADEFC-11EC-4E29-8A95-4AF59DB6CEAE"}, {"criteria": "cpe:2.3:a:microsoft:visio:2007:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6C98FD6E-B9EA-4231-8127-31A8D2D25040"}, {"criteria": "cpe:2.3:a:microsoft:visio:2007:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E822A55C-0440-4622-9284-A5DF70D49C63"}], "operator": "OR"}]}], "evaluatorImpact": "Per: http://www.microsoft.com/technet/security/Bulletin/MS10-028.mspx\r\n\r\n'Users of Microsoft Office Visio 2002 and later versions of Visio will be prompted with Open, Save, or Cancel before opening a document. This is a mitigating factor because the vulnerability requires more than a single user action to complete the exploit.'", "sourceIdentifier": "secure@microsoft.com"}