CVE-2010-1254

The installation for Microsoft Open XML File Format Converter for Mac sets insecure ACLs for the /Applications folder, which allows local users to execute arbitrary code by replacing the executable with a Trojan Horse, aka "Mac Office Open XML Permissions Vulnerability."

CVSS v2.0 6.9 MEDIUM

6.9^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 3.4 / Impact : 10.0

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.securityfocus.com/bid/40533
http://www.us-cert.gov/cas/techalerts/TA10-159B.html	US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-038
http://www.securityfocus.com/bid/40533
http://www.us-cert.gov/cas/techalerts/TA10-159B.html	US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-038

Configurations

Configuration 1 (hide)

cpe:2.3:a:microsoft:open_xml_file_format_converter:*:*:mac:*:*:*:*:*

History

No history.

Information

Published : 2010-06-08 20:30

Updated : 2025-04-11 00:51

NVD link : CVE-2010-1254

Mitre link : CVE-2010-1254

CVE.ORG link : CVE-2010-1254

JSON object : View

Products Affected

microsoft

open_xml_file_format_converter

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2010-1254", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "MEDIUM", "obtainAllPrivilege": true, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2010-06-08T20:30:02.333", "references": [{"url": "http://www.securityfocus.com/bid/40533", "source": "secure@microsoft.com"}, {"url": "http://www.us-cert.gov/cas/techalerts/TA10-159B.html", "tags": ["US Government Resource"], "source": "secure@microsoft.com"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-038", "source": "secure@microsoft.com"}, {"url": "http://www.securityfocus.com/bid/40533", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.us-cert.gov/cas/techalerts/TA10-159B.html", "tags": ["US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-038", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "The installation for Microsoft Open XML File Format Converter for Mac sets insecure ACLs for the /Applications folder, which allows local users to execute arbitrary code by replacing the executable with a Trojan Horse, aka \"Mac Office Open XML Permissions Vulnerability.\""}, {"lang": "es", "value": "La instalaci\u00f3n de Microsoft Open XML File Format Converter para Mac asigna ACLs inseguros a la carpeta /Applications, lo que permite a usuarios locales ejecutar c\u00f3digo de su elecci\u00f3n mediante la sustituci\u00f3n del ejecutable con un caballo de Troya. Esta vulnerabilidad tambi\u00e9n es conocida como \"Vulnerabilidad de permisos en Open XML para Mac Office\""}], "lastModified": "2025-04-11T00:51:21.963", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:open_xml_file_format_converter:*:*:mac:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3807A4E4-EB58-47B6-AD98-6ED464DEBA4E"}], "operator": "OR"}]}], "sourceIdentifier": "secure@microsoft.com"}