CVE-2012-1854

2012-07-1021:55:05

microsoft

web.nvd.nist.gov

144

microsoft

office 2003

vbe6.dll

vulnerability

security

nvd

cve-2012-1854

CVSS2

6.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

AI Score

6.4

Confidence

Low

EPSS

0.001

Percentile

17.5%

JSON

Untrusted search path vulnerability in VBE6.dll in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Microsoft Visual Basic for Applications (VBA); and Summit Microsoft Visual Basic for Applications SDK allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .docx file, aka “Visual Basic for Applications Insecure Library Loading Vulnerability,” as exploited in the wild in July 2012.

Affected configurations

Nvd

Node

microsoftofficeMatch2003sp3

microsoftofficeMatch2007sp2

microsoftofficeMatch2007sp3

microsoftofficeMatch2010x86

microsoftofficeMatch2010sp1

microsoftofficeMatch2010sp1x64

microsoftofficeMatch2010sp1x86

microsoftvisual_basic_for_applications

microsoftvisual_basic_for_applications_sdk

VendorProductVersionCPE
microsoftoffice2003cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:*
microsoftoffice2007cpe:2.3:a:microsoft:office:2007:sp2:*:*:*:*:*:*
microsoftoffice2007cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:*
microsoftoffice2010cpe:2.3:a:microsoft:office:2010:*:x86:*:*:*:*:*
microsoftoffice2010cpe:2.3:a:microsoft:office:2010:sp1:*:*:*:*:*:*
microsoftoffice2010cpe:2.3:a:microsoft:office:2010:sp1:x64:*:*:*:*:*
microsoftoffice2010cpe:2.3:a:microsoft:office:2010:sp1:x86:*:*:*:*:*
microsoftvisual_basic_for_applications*cpe:2.3:a:microsoft:visual_basic_for_applications:*:*:*:*:*:*:*:*
microsoftvisual_basic_for_applications_sdk*cpe:2.3:a:microsoft:visual_basic_for_applications_sdk:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
microsoft	office	2003	cpe:2.3:a:microsoft:office:2003:sp3::::::
microsoft	office	2007	cpe:2.3:a:microsoft:office:2007:sp2::::::
microsoft	office	2007	cpe:2.3:a:microsoft:office:2007:sp3::::::
microsoft	office	2010	cpe:2.3:a:microsoft:office:2010::x86:::::
microsoft	office	2010	cpe:2.3:a:microsoft:office:2010:sp1::::::
microsoft	office	2010	cpe:2.3:a:microsoft:office:2010:sp1:x64:::::*
microsoft	office	2010	cpe:2.3:a:microsoft:office:2010:sp1:x86:::::*
microsoft	visual_basic_for_applications	*	cpe:2.3:a:microsoft:visual_basic_for_applications::::::::
microsoft	visual_basic_for_applications_sdk	*	cpe:2.3:a:microsoft:visual_basic_for_applications_sdk::::::::