CVE-2011-0027
Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2, and Windows Data Access Components (WDAC) 6.0, does not properly validate memory allocation for internal data structures, which allows remote attackers to execute arbitrary code, possibly via a…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 54.4%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2, and Windows Data Access Components (WDAC) 6.0, does not properly validate memory allocation for internal data structures, which allows remote attackers to execute arbitrary code, possibly via a large CacheSize property that triggers an integer wrap and a buffer overflow, aka "ADO Record Memory Vulnerability." NOTE: this might be a duplicate of CVE-2010-1117 or CVE-2010-1118.
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 54.37% probability · 99th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- microsoft/data access components · microsoft/windows data access components
- Source
- secure@microsoft.com
References
- http://osvdb.org/70444
- http://secunia.com/advisories/42804Vendor Advisory
- http://support.avaya.com/css/P8/documents/100124846
- http://vreugdenhilresearch.nl/ms11-002-pwn2own-heap-overflow/
- http://www.securityfocus.com/bid/45698
- http://www.securitytracker.com/id?1024947
- http://www.us-cert.gov/cas/techalerts/TA11-011A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2011/0075Vendor Advisory
- http://www.zerodayinitiative.com/advisories/ZDI-11-002/
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-002
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12411
- http://osvdb.org/70444
- http://secunia.com/advisories/42804Vendor Advisory
- http://support.avaya.com/css/P8/documents/100124846
- http://vreugdenhilresearch.nl/ms11-002-pwn2own-heap-overflow/
- http://www.securityfocus.com/bid/45698
- http://www.securitytracker.com/id?1024947
- http://www.us-cert.gov/cas/techalerts/TA11-011A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2011/0075Vendor Advisory
- http://www.zerodayinitiative.com/advisories/ZDI-11-002/
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-002
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12411
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.