CVE-2010-0252

10.02.2010, 18:30

The Microsoft Data Analyzer ActiveX control (aka the Office Excel ActiveX control for Data Analysis) in max3activex.dll in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows remote attackers to execute arbitrary code via a crafted web page that corrupts the "system state," aka "Microsoft Data Analyzer ActiveX Control Vulnerability."

Code Injection

Severity

UNKNOWN

AV:N/AC:M/Au:N/C:C/I:C/A:C

Atk. Vector

NETWORK

Atk. Complexity

MEDIUM

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Vendor	Product	Version
microsoft	windows_2000	*
microsoft	windows_xp	*
microsoft	windows_xp	*
microsoft	windows_xp	-
microsoft	windows_2003_server	*
microsoft	windows_2003_server	*
microsoft	windows_2003_server	*
microsoft	windows_vista	*
microsoft	windows_vista	*
microsoft	windows_vista	-
microsoft	windows_vista	-
microsoft	windows_server_2008	*
microsoft	windows_server_2008	*
microsoft	windows_server_2008	*
microsoft	windows_server_2008	*
microsoft	windows_server_2008	*
microsoft	windows_server_2008	-
microsoft	windows_7	-

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-94 - Improper Control of Generation of Code ('Code Injection')
The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References

http://secunia.com/advisories/38503

http://secunia.com/advisories/40059

http://www.us-cert.gov/cas/techalerts/TA10-040A.html

http://www.us-cert.gov/cas/techalerts/TA10-159B.html

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-008

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-034

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8424