Overview
» IDS/IPS Signatures
Security Sites
iPolicy Networks Security Advisory
 

Microsoft Office Access ACCWIZ ActiveX Control Code Execution Vulnerability
Date Discovered: 07/13/2010
Severity: High
Operating Systems Affected: Microsoft Windows
Application Affected: Microsoft Office 2003 SP 3
Microsoft Office System 2007 SP 1
Microsoft Office System 2007 SP 2
Identifiers: CVE-2010-1881
Synopsis
Microsoft Office Access ACCWIZ ActiveX Control is vulnerable to remote code execution attack.
Recommended Actions
Patch is available from vendor at following link:-
http://www.microsoft.com/technet/security/bulletin/ms10-044.mspx
Threat Analysis
Microsoft Access Wizard Controls is a runtime component of Microsoft Office Access that provides a library of Access ActiveX controls such as the ImexGrid control and the FieldList control.

There is a remote code execution vulnerability exists in the way Internet Explorer handles memory allocation when instantiating a succession of Access ActiveX controls.

Remote attacker can exploit this issue via crafting a web page and entice the user to open this web page using Internet Explorer browser.
References

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1881
Write-up by: Vikrant