Vulnerability Name:

CVE-2011-0027 (CCN-64341)

Assigned:2010-12-10
Published:2011-01-11
Updated:2019-02-26
Summary:Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2, and Windows Data Access Components (WDAC) 6.0, does not properly validate memory allocation for internal data structures, which allows remote attackers to execute arbitrary code, possibly via a large CacheSize property that triggers an integer wrap and a buffer overflow, aka "ADO Record Memory Vulnerability."
Note: this might be a duplicate of CVE-2010-1117 or CVE-2010-1118.
CVSS v3 Severity:10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
7.3 High (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:POC/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
9.3 High (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
7.3 High (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:POC/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-20
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2011-0027

Source: OSVDB
Type: UNKNOWN
70444

Source: CCN
Type: SA42804
Microsoft Data Access Components Two Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
42804

Source: CCN
Type: SECTRACK ID: 1024947
Microsoft Data Access Components (MDAC) Memory Corruption Errors in Processing DSN Data and ADO Records Let Remote Users Execute Arbitrary Code

Source: CONFIRM
Type: UNKNOWN
http://support.avaya.com/css/P8/documents/100124846

Source: MISC
Type: UNKNOWN
http://vreugdenhilresearch.nl/ms11-002-pwn2own-heap-overflow/

Source: CCN
Type: Microsoft Security Bulletin MS11-002
Vulnerabilities in Microsoft Data Access Components Could Allow Remote Code Execution (2451910)

Source: CCN
Type: OSVDB ID: 70444
Microsoft Data Access Components (MDAC / WDAC) MSADO Record CacheSize Handling Remote Code Execution

Source: BID
Type: UNKNOWN
45698

Source: CCN
Type: BID-45698
Microsoft Data Access Components ActiveX Data Objects Memory Corruption Vulnerability

Source: SECTRACK
Type: UNKNOWN
1024947

Source: CERT
Type: US Government Resource
TA11-011A

Source: VUPEN
Type: Vendor Advisory
ADV-2011-0075

Source: MISC
Type: UNKNOWN
http://www.zerodayinitiative.com/advisories/ZDI-11-002/

Source: MS
Type: UNKNOWN
MS11-002

Source: XF
Type: UNKNOWN
mdac-ado-code-execution(64341)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:12411

Source: EXPLOIT-DB
Type: EXPLOIT
Offensive Security Exploit Database [01-12-2011]

Source: CCN
Type: ZDI-11-002
Microsoft Internet Explorer MSADO CacheSize Remote Code Execution Vulnerability

Vulnerable Configuration:Configuration 1:
  • cpe:/a:microsoft:data_access_components:2.8:sp1:*:*:*:*:*:*
  • AND
  • cpe:/o:microsoft:windows_xp:*:*:*:*:*:*:*:*

  • Configuration 2:
  • cpe:/a:microsoft:data_access_components:2.8:sp2:*:*:*:*:*:*
  • AND
  • cpe:/o:microsoft:windows_2003_server:*:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_xp:-:sp2:x64:*:*:*:*:*

  • Configuration 3:
  • cpe:/a:microsoft:windows_data_access_components:6.0:*:*:*:*:*:*:*
  • AND
  • cpe:/o:microsoft:windows_7:-:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:itanium:*
  • OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:x32:*
  • OR cpe:/o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:x32:*
  • OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:x64:*
  • OR cpe:/o:microsoft:windows_server_2008:-:sp2:itanium:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2008:r2:*:*:*:*:*:itanium:*
  • OR cpe:/o:microsoft:windows_server_2008:r2:*:*:*:*:*:x64:*
  • OR cpe:/o:microsoft:windows_vista:*:sp1:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:*:sp1:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:*:sp2:x64:*:*:*:*:*

  • Configuration CCN 1:
  • cpe:/a:microsoft:data_access_components:2.8:sp1:*:*:*:*:*:*
  • OR cpe:/a:microsoft:data_access_components:2.8:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:x32:*
  • OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:itanium:*
  • AND
  • cpe:/o:microsoft:windows:server_2003:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:server_2003:sp2:itanium:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:server_2003:sp2:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_xp::sp2:x64:*:professional:*:*:*
  • OR cpe:/o:microsoft:windows_vista:-:sp1:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:-:sp1:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:itanium:*
  • OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:x64:*
  • OR cpe:/o:microsoft:windows:xp:sp3:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:-:sp2:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:x32:*
  • OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:x64:*
  • OR cpe:/o:microsoft:windows_7:-:-:*:*:ultimate_n:*:x64:*
  • OR cpe:/o:microsoft:windows_7:-:*:*:*:*:*:x32:*
  • OR cpe:/o:microsoft:windows_server_2008:r2:*:*:*:*:*:x64:*
  • OR cpe:/o:microsoft:windows_server_2008:r2:*:*:*:*:*:itanium:*

  • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:12411
    V
    ADO Record Memory Vulnerability
    2015-08-10
    BACK
    microsoft data access components 2.8 sp1
    microsoft windows xp *
    microsoft data access components 2.8 sp2
    microsoft windows 2003 server * sp2
    microsoft windows server 2003 * sp2
    microsoft windows xp - sp2
    microsoft windows data access components 6.0
    microsoft windows 7 -
    microsoft windows server 2008 *
    microsoft windows server 2008 *
    microsoft windows server 2008 *
    microsoft windows server 2008 * sp2
    microsoft windows server 2008 * sp2
    microsoft windows server 2008 - sp2
    microsoft windows server 2008 r2
    microsoft windows server 2008 r2
    microsoft windows vista * sp1
    microsoft windows vista * sp1
    microsoft windows vista * sp2
    microsoft windows vista * sp2
    microsoft data access components 2.8 sp1
    microsoft data access components 2.8 sp2
    microsoft windows server 2008 -
    microsoft windows server 2008
    microsoft windows server_2003 sp2
    microsoft windows server_2003 sp2
    microsoft windows server_2003 sp2
    microsoft windows xp sp2
    microsoft windows vista - sp1
    microsoft windows vista - sp1
    microsoft windows server 2008 -
    microsoft windows server 2008 -
    microsoft windows xp sp3
    microsoft windows vista - sp2
    microsoft windows vista - sp2
    microsoft windows server 2008 sp2
    microsoft windows server 2008 sp2
    microsoft windows 7 -
    microsoft windows 7 -
    microsoft windows server 2008 - r2
    microsoft windows server 2008 r2