CVE-2004-0901
CVSS10.0
发布时间 :2005-01-10 00:00:00
修订时间 :2008-09-10 15:28:12
NMCOPS    

[原文]Microsoft Word for Windows 6.0 Converter (MSWRD632.WPC), as used in WordPad, does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Font Conversion Vulnerability," a different vulnerability than CVE-2004-0571.


[CNNVD]Microsft WordPad MSWRD632.WPC 代码执行漏洞(CNNVD-200501-048)

        WordPad是使用MFC rich编辑控制类的文字处理应用程序,默认安装在所有Windows系统中,包含从其他文件类型转换为RTF的过滤器。
        WordPad中所使用的MSWRD632.WPC转换器没有正确校验数据长度,导致其存在代码执行漏洞。
        攻击者可利用此漏洞,通过构建的恶意文档(.wri、 .rtf及.doc文件)执行任意代码。

- CVSS (基础分值)

CVSS分值: 10 [严重(HIGH)]
机密性影响: COMPLETE [完全的信息泄露导致所有系统文件暴露]
完整性影响: COMPLETE [系统完整性可被完全破坏]
可用性影响: COMPLETE [可能导致系统完全宕机]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: [--]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)

cpe:/o:microsoft:windows_nt:4.0:sp1:serverMicrosoft Windows 4.0 sp1 server
cpe:/o:microsoft:windows_meMicrosoft Windows ME
cpe:/o:microsoft:windows_98::goldMicrosoft windows 98_gold
cpe:/o:microsoft:windows_2000::sp1:datacenter_serverMicrosoft Windows 2000 Datacenter Server SP1
cpe:/o:microsoft:windows_nt:4.0::server
cpe:/o:microsoft:windows_nt:4.0:sp5:workstationMicrosoft Windows 4.0 sp5 workstation
cpe:/o:microsoft:windows_nt:4.0:sp3:workstationMicrosoft Windows 4.0 sp3 workstation
cpe:/o:microsoft:windows_xp::gold:professionalMicrosoft Windows XP Professional Gold
cpe:/o:microsoft:windows_2003_server:r2::datacenter_64-bit
cpe:/o:microsoft:windows_nt:4.0::enterprise_server
cpe:/o:microsoft:windows_2000::sp2:advanced_serverMicrosoft Windows 2000 Advanced Server SP2
cpe:/o:microsoft:windows_2003_server:enterprise::64-bit
cpe:/o:microsoft:windows_2000::sp2:professionalMicrosoft Windows 2000 Professional SP2
cpe:/o:microsoft:windows_nt:4.0:sp1:workstationMicrosoft Windows 4.0 sp1 workstation
cpe:/o:microsoft:windows_nt:4.0:sp4:workstationMicrosoft Windows 4.0 sp4 workstation
cpe:/o:microsoft:windows_nt:4.0:sp5:enterprise_server
cpe:/o:microsoft:windows_2000:::professional
cpe:/o:microsoft:windows_xp::sp1:home
cpe:/o:microsoft:windows_nt:4.0:sp6a:serverMicrosoft Windows 4.0 sp6a server
cpe:/o:microsoft:windows_2003_server:standard::64-bit
cpe:/o:microsoft:windows_2003_server:enterprise_64-bit
cpe:/o:microsoft:windows_98seMicrosoft windows 98_se
cpe:/o:microsoft:windows_2000::sp1:professionalMicrosoft Windows 2000 Professional SP1
cpe:/o:microsoft:windows_nt:4.0:sp6:terminal_serverMicrosoft Windows NT Terminal Server 4.0 SP6
cpe:/o:microsoft:windows_nt:4.0:sp2:enterprise_server
cpe:/o:microsoft:windows_xp:::home
cpe:/o:microsoft:windows_nt:4.0:sp2:serverMicrosoft Windows 4.0 sp2 server
cpe:/o:microsoft:windows_nt:4.0:sp3:serverMicrosoft Windows 4.0 sp3 server
cpe:/o:microsoft:windows_nt:4.0:sp4:enterprise_server
cpe:/o:microsoft:windows_xp:::64-bit
cpe:/o:microsoft:windows_nt:4.0:sp4:terminal_serverMicrosoft Windows NT Terminal Server 4.0 SP4
cpe:/o:microsoft:windows_2000::sp2:datacenter_serverMicrosoft Windows 2000 Datacenter Server SP2
cpe:/o:microsoft:windows_xp::sp2:home
cpe:/o:microsoft:windows_2000::sp4:datacenter_serverMicrosoft Windows 2000 Datacenter Server SP4
cpe:/o:microsoft:windows_2000:::server
cpe:/o:microsoft:windows_nt:4.0:sp6:serverMicrosoft Windows 4.0 sp6 server
cpe:/o:microsoft:windows_nt:4.0:sp1:terminal_serverMicrosoft Windows NT Terminal Server 4.0 SP1
cpe:/o:microsoft:windows_nt:4.0:sp3:terminal_serverMicrosoft Windows NT Terminal Server 4.0 SP3
cpe:/o:microsoft:windows_nt:4.0:sp4:serverMicrosoft Windows 4.0 sp4 server
cpe:/o:microsoft:windows_nt:4.0::terminal_server
cpe:/o:microsoft:windows_nt:4.0:sp1:enterprise_server
cpe:/o:microsoft:windows_nt:4.0:sp6a:enterprise_server
cpe:/o:microsoft:windows_2003_server:r2::64-bit
cpe:/o:microsoft:windows_2000::sp3:datacenter_serverMicrosoft Windows 2000 Datacenter Server SP3
cpe:/o:microsoft:windows_nt:4.0:sp6a:workstationMicrosoft Windows 4.0 sp6a workstation
cpe:/o:microsoft:windows_nt:4.0:sp6:enterprise_server
cpe:/o:microsoft:windows_2000::sp3:serverMicrosoft Windows 2000 Server SP3
cpe:/o:microsoft:windows_2000:::advanced_server
cpe:/o:microsoft:windows_nt:4.0:sp2:workstationMicrosoft Windows 4.0 sp2 workstation
cpe:/o:microsoft:windows_nt:4.0:sp3:enterprise_server
cpe:/o:microsoft:windows_xp::sp1:64-bit
cpe:/o:microsoft:windows_2000::sp4:serverMicrosoft Windows 2000 Server SP4
cpe:/o:microsoft:windows_2000:::datacenter_server
cpe:/o:microsoft:windows_2000::sp3:professionalMicrosoft Windows 2000 Professional SP3
cpe:/o:microsoft:windows_2000::sp1:serverMicrosoft Windows 2000 Server SP1
cpe:/o:microsoft:windows_2000::sp3:advanced_serverMicrosoft Windows 2000 Advanced Server SP3
cpe:/o:microsoft:windows_2003_server:web
cpe:/o:microsoft:windows_nt:4.0:sp5:serverMicrosoft Windows 4.0 sp5 server
cpe:/o:microsoft:windows_2000::sp1:advanced_serverMicrosoft Windows 2000 Advanced Server SP1
cpe:/o:microsoft:windows_nt:4.0::workstation
cpe:/o:microsoft:windows_nt:4.0:sp5:terminal_serverMicrosoft Windows NT Terminal Server 4.0 SP5
cpe:/o:microsoft:windows_2000::sp2:serverMicrosoft Windows 2000 Server SP2
cpe:/o:microsoft:windows_nt:4.0:sp6:workstationMicrosoft Windows 4.0 sp6 workstation
cpe:/o:microsoft:windows_nt:4.0:sp2:terminal_serverMicrosoft Windows NT Terminal Server 4.0 SP2
cpe:/o:microsoft:windows_2000::sp4:professionalMicrosoft Windows 2000 Professional SP4
cpe:/o:microsoft:windows_2000::sp4:advanced_serverMicrosoft Windows 2000 Advanced Server SP4

- OVAL (用于检测的技术细节)

oval:org.mitre.oval:def:539MS Word 6.0 Font Conversion Vulnerability (64-bit XP)
oval:org.mitre.oval:def:4749Suppressed: Duplicate of OVAL3882
oval:org.mitre.oval:def:4576MS Word 6.0 Font Conversion Vulnerability (NT Terminal Server)
oval:org.mitre.oval:def:4076Suppressed: Duplicate of OVAL1655
oval:org.mitre.oval:def:3882MS Word 6.0 Font Conversion Vulnerability (32-bit XP)
oval:org.mitre.oval:def:3310MS Word 6.0 Font Conversion Vulnerability (NT 4.0)
oval:org.mitre.oval:def:1655MS Word 6.0 Font Conversion Vulnerability (Server 2003)
oval:org.mitre.oval:def:1241MS Word 6.0 Font Conversion Vulnerability (Windows 2000)
oval:gov.nist.fdcc.patch:def:11527MS04-041: Vulnerability in WordPad Could Allow Code Execution (885836)
oval:gov.nist.USGCB.patch:def:11527MS04-041: Vulnerability in WordPad Could Allow Code Execution (885836)
*OVAL详细的描述了检测该漏洞的方法,你可以从相关的OVAL定义中找到更多检测该漏洞的技术细节。

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0901
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2004-0901
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200501-048
(官方数据源) CNNVD

- 其它链接及资源

http://www.microsoft.com/technet/security/bulletin/ms04-041.asp
(VENDOR_ADVISORY)  MS  MS04-041
http://xforce.iss.net/xforce/xfdb/18338
(UNKNOWN)  XF  win-converter-font-code-execution(18338)
http://www.ciac.org/ciac/bulletins/p-055.shtml
(UNKNOWN)  CIAC  P-055
http://www.idefense.com/application/poi/display?id=162&type=vulnerabilities&flashstatus=true
(UNKNOWN)  IDEFENSE  20041214 Microsoft Word 6.0/95 Document Converter Buffer Overflow Vulnerability

- 漏洞信息

Microsft WordPad MSWRD632.WPC 代码执行漏洞
危急 边界条件错误
2005-01-10 00:00:00 2005-10-28 00:00:00
远程  
        WordPad是使用MFC rich编辑控制类的文字处理应用程序,默认安装在所有Windows系统中,包含从其他文件类型转换为RTF的过滤器。
        WordPad中所使用的MSWRD632.WPC转换器没有正确校验数据长度,导致其存在代码执行漏洞。
        攻击者可利用此漏洞,通过构建的恶意文档(.wri、 .rtf及.doc文件)执行任意代码。

- 公告与补丁

        目前厂商已经发布了升级补丁以修复此安全问题,补丁获取链接:
        http://www.microsoft.com/technet/security/bulletin/ms04-041.mspx

- 漏洞信息 (F35340)

iDEFENSE Security Advisory 2004-12-14.2 (PacketStormID:F35340)
2004-12-30 00:00:00
iDefense Labs,Lord Yup  idefense.com
advisory,remote,overflow,arbitrary
CVE-2004-0901
[点击下载]

iDEFENSE Security Advisory 12.14.2004-2 - Remote exploitation of a buffer overflow vulnerability in Microsoft Corp.'s Word 6.0/95 Document Converter could allow attackers to exploit arbitrary code under the privileges of the target user.

Microsoft Word 6.0/95 Document Converter Buffer Overflow Vulnerability 

iDEFENSE Security Advisory 12.14.04
www.idefense.com/application/poi/display?id=162&type=vulnerabilities
December 14, 2004

I. BACKGROUND

WordPad is a word processing application that uses the MFC rich edit 
control classes. It is installed by default on most Windows platforms,
and contains filters for converting from other filetypes into RTF 
(Rich Text Format).

II. DESCRIPTION

Remote exploitation of a buffer overflow vulnerability in Microsoft 
Corp.'s Word 6.0/95 Document Converter could allow attackers to exploit 
arbitrary code under the privileges of the target user.

The Microsoft Word 6.0/95 Document Converter (MSWRD632.WPC) is a module
that is utilized by WordPad and potentially other applications to 
convert Microsoft Word format files into the Rich Text Format natively 
handled by WordPad. The module is installed by default in

C:\Program Files\Common Files\Microsoft Shared\TextConv

The problem specifically exists when a specially crafted file is 
opened by WordPad or another application that utilizes the vulnerable 
library and results in a buffer overflow. The overflow is caused by 
copying a length tagged segment of a file into a fixed length stack 
buffer of smaller size. The following instruction sequence is found 
within ConvertForeignToRtf():

0150eba6   8bd1      mov edx, ecx
0150eba8   83e203    and edx, 0x3
0150ebab   c1e902    shr ecx, 0x2
0150ebae   f3a5      rep movsd edi, esi

This instruction sequence will copy bytes from the memory region 
pointed to by ESI into the memory region pointed to by EDI. Due to a 
lack of bounds checking, an overflow occurs directly overwriting the 
stored return address and frame pointer on the stack and allowing for 
the eventual execution of arbitrary code.

III. ANALYSIS

Successful exploitation allows remote attackers to execute arbitrary 
code under the privileges of the target user that opened the malicious 
document. WordPad, a vulnerable application, is installed by default 
and will open WRI and large TXT files. If Microsoft Word is not 
installed, WordPad will also be the default application for opening 
DOC and RTF files.

In order for this vulnerability to be exploited, a user would need to 
open an attacker-supplied file with a vulnerable application.

IV. DETECTION

The following operating systems appear to be impacted by this
vulnerability in their default configuration:

  Windows XP 
  Windows 2000
  Windows 2003
  Windows NT 4.0
  Windows ME
  Windows 98

iDEFENSE Labs has confirmed that MSWRD632.WPC, file version 1999.8.7.0 
is vulnerable. Any application that utilizes this module to convert Word

documents may be considered vulnerable. This includes wordpad.exe, which

is the default application for opening files with the .wri extension, 
and .doc and .rtf files if Microsoft Word is not installed.

It does not seem to be possible to exploit Microsoft Word itself with 
this vulnerability, as it does not appear to use this library.

As this module comes with Windows by default, even if you have Word 
installed, WordPad is still vulnerable to exploitation from files with
the  .wri extension, or by opening an affected file from within WordPad.

V. WORKAROUND

User awareness is the best defense against this class of attack. Users 
should be aware of the existence of such attacks and proceed with 
caution when following links or opening attachments from suspicious 
and/or unsolicited e-mail.

Alternatively, concerned users can remove the affected converter module,

MSWRD632.WPC. This will prevent the user from opening Word for Windows 
files, but will still allow other supported file types to be opened such

as .txt or .rtf. However, the error will be handled gracefully and the 
described vulnerability will no longer be exploitable.

VI. VENDOR RESPONSE

This vulnerability is addressed in Microsoft Security Bulletin MS04-041
available at:

http://www.microsoft.com/technet/security/Bulletin/MS04-041.mspx

VII. CVE INFORMATION

The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CAN-2004-0901 to this issue. This is a candidate for inclusion
in the CVE list (http://cve.mitre.org), which standardizes names for
security problems.

VIII. DISCLOSURE TIMELINE

09/22/2004  Initial vendor notification
09/23/2004  Initial vendor response
12/14/2004  Coordinated public disclosure

IX. CREDIT

This vulnerability was discovered by Lord Yup.

Get paid for vulnerability research
http://www.idefense.com/poi/teams/vcp.jsp

X. LEGAL NOTICES

Copyright (c) 2004 iDEFENSE, Inc.

Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDEFENSE. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically, please
email customerservice@idefense.com for permission.

Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on,
this information.
    

- 漏洞信息

12375
Microsoft Word / Wordpad Font Converter Remote Overflow
Remote / Network Access Input Manipulation
Loss of Integrity
Exploit Unknown

- 漏洞描述

A remote overflow exists in the Microsoft Word for Windows font Converter within the Microsoft Windows operating systems. The program fails to perform proper bounds checking in ConvertForeignToRtf() resulting in a buffer overflow. With a specially crafted request, an attacker may be able to execute aribtrary code remotely, resulting in a loss of integrity.

- 时间线

2004-12-14 Unknow
Unknow Unknow

- 解决方案

Currently, there are no known workarounds or upgrades to correct this issue. However, Microsoft has released a patch to address this vulnerability.

- 相关参考

- 漏洞作者

- 漏洞信息

Microsoft Word for Windows 6.0 Converter Font Conversion Buffer Overflow Vulnerability
Boundary Condition Error 11929
Yes No
2004-12-14 12:00:00 2009-07-12 09:26:00
Discovery is credited to Lord Yup and iDefense.

- 受影响的程序版本

Microsoft Windows XP Professional SP2
Microsoft Windows XP Professional SP1
Microsoft Windows XP Professional
Microsoft Windows XP Home SP2
Microsoft Windows XP Home SP1
Microsoft Windows XP Home
Microsoft Windows XP 64-bit Edition Version 2003 SP1
Microsoft Windows XP 64-bit Edition Version 2003
Microsoft Windows XP 64-bit Edition SP1
Microsoft Windows XP 64-bit Edition
Microsoft Windows Server 2003 Web Edition
Microsoft Windows Server 2003 Standard Edition
Microsoft Windows Server 2003 Enterprise Edition Itanium 0
Microsoft Windows Server 2003 Enterprise Edition
Microsoft Windows Server 2003 Datacenter Edition Itanium 0
Microsoft Windows Server 2003 Datacenter Edition
Microsoft Windows NT Workstation 4.0 SP6a
Microsoft Windows NT Workstation 4.0 SP6
Microsoft Windows NT Workstation 4.0 SP5
Microsoft Windows NT Workstation 4.0 SP4
Microsoft Windows NT Workstation 4.0 SP3
Microsoft Windows NT Workstation 4.0 SP2
Microsoft Windows NT Workstation 4.0 SP1
Microsoft Windows NT Workstation 4.0
Microsoft Windows NT Terminal Server 4.0 SP6a
Microsoft Windows NT Terminal Server 4.0 SP6
Microsoft Windows NT Terminal Server 4.0 SP5
Microsoft Windows NT Terminal Server 4.0 SP4
Microsoft Windows NT Terminal Server 4.0 SP3
Microsoft Windows NT Terminal Server 4.0 SP2
Microsoft Windows NT Terminal Server 4.0 SP1
Microsoft Windows NT Terminal Server 4.0
Microsoft Windows NT Server 4.0 SP6a
+ Avaya DefinityOne Media Servers
+ Avaya DefinityOne Media Servers
+ Avaya IP600 Media Servers
+ Avaya IP600 Media Servers
+ Avaya S3400 Message Application Server 0
+ Avaya S8100 Media Servers 0
+ Avaya S8100 Media Servers 0
Microsoft Windows NT Server 4.0 SP6
Microsoft Windows NT Server 4.0 SP5
Microsoft Windows NT Server 4.0 SP4
Microsoft Windows NT Server 4.0 SP3
Microsoft Windows NT Server 4.0 SP2
Microsoft Windows NT Server 4.0 SP1
Microsoft Windows NT Server 4.0
Microsoft Windows NT Enterprise Server 4.0 SP6a
Microsoft Windows NT Enterprise Server 4.0 SP6
Microsoft Windows NT Enterprise Server 4.0 SP5
Microsoft Windows NT Enterprise Server 4.0 SP4
Microsoft Windows NT Enterprise Server 4.0 SP3
Microsoft Windows NT Enterprise Server 4.0 SP2
Microsoft Windows NT Enterprise Server 4.0 SP1
Microsoft Windows NT Enterprise Server 4.0
Microsoft Windows ME
Microsoft Windows 98SE
Microsoft Windows 98
Microsoft Windows 2000 Server SP4
Microsoft Windows 2000 Server SP3
Microsoft Windows 2000 Server SP2
Microsoft Windows 2000 Server SP1
Microsoft Windows 2000 Server
+ Avaya DefinityOne Media Servers
+ Avaya IP600 Media Servers
+ Avaya S3400 Message Application Server 0
+ Avaya S8100 Media Servers 0
Microsoft Windows 2000 Professional SP4
Microsoft Windows 2000 Professional SP3
Microsoft Windows 2000 Professional SP2
Microsoft Windows 2000 Professional SP1
Microsoft Windows 2000 Professional
Microsoft Windows 2000 Datacenter Server SP4
Microsoft Windows 2000 Datacenter Server SP3
Microsoft Windows 2000 Datacenter Server SP2
Microsoft Windows 2000 Datacenter Server SP1
Microsoft Windows 2000 Datacenter Server
Microsoft Windows 2000 Advanced Server SP4
Microsoft Windows 2000 Advanced Server SP3
Microsoft Windows 2000 Advanced Server SP2
Microsoft Windows 2000 Advanced Server SP1
Microsoft Windows 2000 Advanced Server

- 漏洞讨论

Microsoft Word for Windows 6.0 Converter is reported prone to a buffer overflow vulnerability. An attacker may exploit this issue to gain unauthorized access to a vulnerable computer in the context of the user running the application. This issue specifically exists in the Font Conversion functionality of the application.

It is reported that this issue may be exploited when a maliciously crafted file is opened in Microsoft WordPad.

Microsoft Word for Windows 6.0 Converter is not enabled by default on Windows XP Service Pack 2 and Windows Server 2003. This issue does not pose a significant risk on Windows 98, 98 SE, and ME; it may only cause a denial of service condition in the application without the possibility of code execution.

- 漏洞利用

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: vuldb@securityfocus.com <mailto:vuldb@securityfocus.com>.

- 解决方案

Microsoft has released updates to address this vulnerability in supported versions of the Windows operating system.


Microsoft Windows NT Server 4.0 SP6a

Microsoft Windows Server 2003 Enterprise Edition Itanium 0

Microsoft Windows NT Terminal Server 4.0 SP6

Microsoft Windows Server 2003 Standard Edition

Microsoft Windows Server 2003 Datacenter Edition Itanium 0

Microsoft Windows NT Workstation 4.0 SP6a

Microsoft Windows XP 64-bit Edition SP1

Microsoft Windows Server 2003 Datacenter Edition

Microsoft Windows 2000 Advanced Server SP4

Microsoft Windows 2000 Professional SP3

Microsoft Windows Server 2003 Enterprise Edition

Microsoft Windows XP Home SP2

Microsoft Windows 2000 Datacenter Server SP4

Microsoft Windows Server 2003 Web Edition

Microsoft Windows 2000 Advanced Server SP3

Microsoft Windows XP Home SP1

Microsoft Windows 2000 Datacenter Server SP3

Microsoft Windows 2000 Server SP3

Microsoft Windows XP 64-bit Edition Version 2003

Microsoft Windows XP Professional SP2

Microsoft Windows NT Enterprise Server 4.0 SP6a

Microsoft Windows 2000 Server SP4

Microsoft Windows 2000 Professional SP4

Microsoft Windows XP Professional SP1

- 相关参考

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站