Signature Detail

SMB: Microsoft Visio Insecure MFC71xxx.DLL Library Loading

This signature detects attempts to exploit a known vulnerability in Microsoft Office Visio 11. It is due to a design weakness in loading Dynamically Linked Libraries. Remote attackers can exploit this by enticing target users to download a malicious dll file from an SMB share. A successful attack can result in loading the attacker-controlled library and execution of arbitrary code with the privileges of the logged-in user. If a user is logged-on with administrative user rights, an attacker can take complete control of the affected system.

Extended Description

Microsoft Visio 2003 is prone to a vulnerability that lets attackers execute arbitrary code. An attacker can exploit this issue by enticing a legitimate user to use the vulnerable application to open a file from a network share location that contains a specially crafted Dynamic Link Library (DLL) file. Microsoft Visio 2003 is vulnerable; other versions may also be affected.

Affected Products

• Microsoft visio_2003 SP1
• Microsoft visio_2003 SP2
• Microsoft visio_2003 SP3
• Microsoft visio_2003
• Microsoft visio_2003_professional
• Microsoft visio_2003_standard

References

• BugTraq: 42681
• CVE: CVE-2010-3148