CVE-2011-0027
Microsoft Internet Explorer MSADO CacheSize Remote Code Execution Vulnerability
Severity Score
9.3
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2, and Windows Data Access Components (WDAC) 6.0, does not properly validate memory allocation for internal data structures, which allows remote attackers to execute arbitrary code, possibly via a large CacheSize property that triggers an integer wrap and a buffer overflow, aka "ADO Record Memory Vulnerability." NOTE: this might be a duplicate of CVE-2010-1117 or CVE-2010-1118.
Microsoft Data Access Components (MDAC) versión 2.8 SP1 y SP2 y Windows Data Access Components (WDAC) versión 6.0 no valida apropiadamente la asignación de memoria para las estructuras de datos internas, lo que permite a los atacantes remotos ejecutar código arbitrario, posiblemente por medio de una propiedad CacheSize larga que desencadena un ajuste de enteros y un desbordamiento del búfer, también se conoce como "ADO Record Memory Vulnerability" Nota: este CVE podría ser un duplicado de CVE-2010-1117 o CVE-2010-1118.
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. This vulnerability was submitted to the ZDI via at the annual Pwn2Own competition at CanSecWest. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The flaw exists within the MSADO component. When handling the a user specified CacheSize property the process uses this value to calculate the 'real' cache size. This value is used without proper validation. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the browser.
*Credits:
Peter Vreugdenhil
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2010-12-10 CVE Reserved
- 2011-01-11 CVE Published
- 2011-01-12 First Exploit
- 2023-12-08 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-20: Improper Input Validation
CAPEC
References (12)
| URL | Tag | Source |
|---|---|---|
| http://osvdb.org/70444 | Vdb Entry | |
| http://support.avaya.com/css/P8/documents/100124846 | X_refsource_confirm | |
| http://vreugdenhilresearch.nl/ms11-002-pwn2own-heap-overflow | X_refsource_misc | |
| http://www.securityfocus.com/bid/45698 | Vdb Entry | |
| http://www.securitytracker.com/id?1024947 | Vdb Entry | |
| http://www.us-cert.gov/cas/techalerts/TA11-011A.html | Third Party Advisory | |
| http://www.zerodayinitiative.com/advisories/ZDI-11-002 | X_refsource_misc |
|
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12411 | Signature |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/15984 | 2011-01-12 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://secunia.com/advisories/42804 | 2023-12-07 | |
| http://www.vupen.com/english/advisories/2011/0075 | 2023-12-07 | |
| https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-002 | 2023-12-07 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Microsoft Search vendor "Microsoft" | Data Access Components Search vendor "Microsoft" for product "Data Access Components" | 2.8 Search vendor "Microsoft" for product "Data Access Components" and version "2.8" | sp1 |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Xp Search vendor "Microsoft" for product "Windows Xp" | * | - |
Safe
|
| Microsoft Search vendor "Microsoft" | Data Access Components Search vendor "Microsoft" for product "Data Access Components" | 2.8 Search vendor "Microsoft" for product "Data Access Components" and version "2.8" | sp2 |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows 2003 Server Search vendor "Microsoft" for product "Windows 2003 Server" | * | sp2 |
Safe
|
| Microsoft Search vendor "Microsoft" | Data Access Components Search vendor "Microsoft" for product "Data Access Components" | 2.8 Search vendor "Microsoft" for product "Data Access Components" and version "2.8" | sp2 |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Server 2003 Search vendor "Microsoft" for product "Windows Server 2003" | * | sp2 |
Safe
|
| Microsoft Search vendor "Microsoft" | Data Access Components Search vendor "Microsoft" for product "Data Access Components" | 2.8 Search vendor "Microsoft" for product "Data Access Components" and version "2.8" | sp2 |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Xp Search vendor "Microsoft" for product "Windows Xp" | - | sp2, x64 |
Safe
|
| Microsoft Search vendor "Microsoft" | Windows Data Access Components Search vendor "Microsoft" for product "Windows Data Access Components" | 6.0 Search vendor "Microsoft" for product "Windows Data Access Components" and version "6.0" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows 7 Search vendor "Microsoft" for product "Windows 7" | - | - |
Safe
|
| Microsoft Search vendor "Microsoft" | Windows Data Access Components Search vendor "Microsoft" for product "Windows Data Access Components" | 6.0 Search vendor "Microsoft" for product "Windows Data Access Components" and version "6.0" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Server 2008 Search vendor "Microsoft" for product "Windows Server 2008" | * | itanium |
Safe
|
| Microsoft Search vendor "Microsoft" | Windows Data Access Components Search vendor "Microsoft" for product "Windows Data Access Components" | 6.0 Search vendor "Microsoft" for product "Windows Data Access Components" and version "6.0" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Server 2008 Search vendor "Microsoft" for product "Windows Server 2008" | * | x32 |
Safe
|
| Microsoft Search vendor "Microsoft" | Windows Data Access Components Search vendor "Microsoft" for product "Windows Data Access Components" | 6.0 Search vendor "Microsoft" for product "Windows Data Access Components" and version "6.0" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Server 2008 Search vendor "Microsoft" for product "Windows Server 2008" | * | x64 |
Safe
|
| Microsoft Search vendor "Microsoft" | Windows Data Access Components Search vendor "Microsoft" for product "Windows Data Access Components" | 6.0 Search vendor "Microsoft" for product "Windows Data Access Components" and version "6.0" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Server 2008 Search vendor "Microsoft" for product "Windows Server 2008" | * | sp2, x32 |
Safe
|
| Microsoft Search vendor "Microsoft" | Windows Data Access Components Search vendor "Microsoft" for product "Windows Data Access Components" | 6.0 Search vendor "Microsoft" for product "Windows Data Access Components" and version "6.0" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Server 2008 Search vendor "Microsoft" for product "Windows Server 2008" | * | sp2, x64 |
Safe
|
| Microsoft Search vendor "Microsoft" | Windows Data Access Components Search vendor "Microsoft" for product "Windows Data Access Components" | 6.0 Search vendor "Microsoft" for product "Windows Data Access Components" and version "6.0" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Server 2008 Search vendor "Microsoft" for product "Windows Server 2008" | - | sp2, itanium |
Safe
|
| Microsoft Search vendor "Microsoft" | Windows Data Access Components Search vendor "Microsoft" for product "Windows Data Access Components" | 6.0 Search vendor "Microsoft" for product "Windows Data Access Components" and version "6.0" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Server 2008 Search vendor "Microsoft" for product "Windows Server 2008" | r2 Search vendor "Microsoft" for product "Windows Server 2008" and version "r2" | itanium |
Safe
|
| Microsoft Search vendor "Microsoft" | Windows Data Access Components Search vendor "Microsoft" for product "Windows Data Access Components" | 6.0 Search vendor "Microsoft" for product "Windows Data Access Components" and version "6.0" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Server 2008 Search vendor "Microsoft" for product "Windows Server 2008" | r2 Search vendor "Microsoft" for product "Windows Server 2008" and version "r2" | x64 |
Safe
|
| Microsoft Search vendor "Microsoft" | Windows Data Access Components Search vendor "Microsoft" for product "Windows Data Access Components" | 6.0 Search vendor "Microsoft" for product "Windows Data Access Components" and version "6.0" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Vista Search vendor "Microsoft" for product "Windows Vista" | * | sp1 |
Safe
|
| Microsoft Search vendor "Microsoft" | Windows Data Access Components Search vendor "Microsoft" for product "Windows Data Access Components" | 6.0 Search vendor "Microsoft" for product "Windows Data Access Components" and version "6.0" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Vista Search vendor "Microsoft" for product "Windows Vista" | * | sp2 |
Safe
|