Microsoft Office Word 2010 Crash PoC

                                                Title     :  Microsoft Office Word 2010 Stack Overflow
Version   :  Microsoft Office professional Plus 2010
Date      :  2012-10-23
Vendor    :  http://office.microsoft.com
Impact    :  Med/High
Contact   :  coolkaveh [at] rocketmail.com
Twitter   :  @coolkaveh
tested    :  XP SP3 ENG
###############################################################################
Bug :
----
StackOverflow during the handling of the doc files a context-dependent attacker 
can execute arbitrary code.
---- 
################################################################################
(be0.59c): Stack overflow - code c00000fd (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00032000 
ebx=00000000 
ecx=00032fe4 
edx=000024bc 
esi=008b8974 
edi=0753e000
eip=316d458e 
esp=000380f0 
ebp=000380f8 iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010206
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files\Microsoft Office\Office14\wwlib.dll - 
wwlib+0x458e:
316d458e 8500            test    dword ptr [eax],eax  ds:0023:00032000=00000000
0:000>!exploitable -v
eax=00032000 ebx=00000000 ecx=00032fe4 edx=000024bc esi=008b8974 edi=0753e000
eip=316d458e esp=000380f0 ebp=000380f8 iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010206
wwlib+0x458e:
316d458e 8500            test    dword ptr [eax],eax  ds:0023:00032000=00000000
HostMachine\HostUser
Executing Processor Architecture is x86
Debuggee is in User Mode
Debuggee is a live user mode debugging session on the local machine
Event Type: Exception
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntdll.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSPTLS.DLL - 
Exception Faulting Address: 0x316d458e
First Chance Exception Type: STATUS_STACK_OVERFLOW (0xC00000FD)

Faulting Instruction:316d458e test dword ptr [eax],eax

Basic Block:
    316d458e test dword ptr [eax],eax
       Tainted Input Operands: eax
    316d4590 jmp wwlib+0x4585 (316d4585)

Exception Hash (Major/Minor): 0x7513030e.0x2d6c2e72

Stack Trace:
wwlib+0x458e
wwlib!GetAllocCounters+0x78520
wwlib!GetAllocCounters+0x90f89
wwlib!GetAllocCounters+0x134cf
wwlib!DllGetLCID+0x6451eb
wwlib!DllGetLCID+0x645c74
wwlib!DllGetLCID+0x29b461
wwlib!DllGetLCID+0x531d6
wwlib!DllGetLCID+0x2c1272
wwlib!DllGetLCID+0x141bf9
wwlib!DllGetLCID+0x1d1144
wwlib!DllGetLCID+0x1d05ae
MSPTLS!LsLwMultDivR+0x101e7
MSPTLS!LsLwMultDivR+0x10afb
MSPTLS!LsLwMultDivR+0x10c5e
MSPTLS!LsLwMultDivR+0x10ec8
MSPTLS!FsTransformBbox+0xe137
MSPTLS!LsLwMultDivR+0x24ac6
MSPTLS!LsLwMultDivR+0x27d0
MSPTLS!LsLwMultDivR+0x25470
MSPTLS!LsLwMultDivR+0x25642
MSPTLS!LsLwMultDivR+0x259ad
MSPTLS!LsLwMultDivR+0x2a64
MSPTLS!LsLwMultDivR+0x3201
MSPTLS!FsTransformBbox+0x74ae
MSPTLS!FsTransformBbox+0x7e28
MSPTLS!FsCreateSubpageFinite+0xad
wwlib!DllGetLCID+0x541fc
wwlib!DllGetLCID+0x54037
MSPTLS!LsLwMultDivR+0x4e92
MSPTLS!LsLwMultDivR+0x29070
MSPTLS!LsLwMultDivR+0x285b0
MSPTLS!LsLwMultDivR+0x5fa3
MSPTLS!LsLwMultDivR+0x6816
MSPTLS!FsTransformBbox+0xb8c1
MSPTLS!FsQueryTableObjFigureListWord+0x2a0
MSPTLS!LsLwMultDivR+0x101e7
MSPTLS!LsLwMultDivR+0x10afb
MSPTLS!LsLwMultDivR+0x10c5e
MSPTLS!LsLwMultDivR+0x10ec8
MSPTLS!FsTransformBbox+0xe137
MSPTLS!LsLwMultDivR+0x24ac6
MSPTLS!LsLwMultDivR+0x27d0
MSPTLS!LsLwMultDivR+0x25470
MSPTLS!LsLwMultDivR+0x25642
MSPTLS!LsLwMultDivR+0x259ad
MSPTLS!LsLwMultDivR+0x2a64
MSPTLS!LsLwMultDivR+0x3201
MSPTLS!FsTransformBbox+0x74ae
MSPTLS!FsTransformBbox+0x7e28
MSPTLS!FsCreateSubpageFinite+0xad
wwlib!DllGetLCID+0x1d07f0
MSPTLS!LsLwMultDivR+0x101e7
MSPTLS!LsLwMultDivR+0x10afb
MSPTLS!LsLwMultDivR+0x10c5e
MSPTLS!LsLwMultDivR+0x10ec8
MSPTLS!FsTransformBbox+0xe137
MSPTLS!LsLwMultDivR+0x24ac6
MSPTLS!LsLwMultDivR+0x27d0
MSPTLS!LsLwMultDivR+0x25470
MSPTLS!LsLwMultDivR+0x25642
MSPTLS!LsLwMultDivR+0x259ad
MSPTLS!LsLwMultDivR+0x2a64
MSPTLS!LsLwMultDivR+0x3201
Instruction Address: 0x00000000316d458e
Description: Stack Overflow
Short Description: StackOverflow
Recommended Bug Title: Stack Overflow starting at wwlib+0x000000000000458e (Hash=0x7513030e.0x2d6c2e72)
##############################################################################################################
Proof of concept poc.doc included.
Exploit-DB Note: This also works on Word 2007

PoC: http://www.exploit-db.com/sploits/22215.tar.gz