|CERT-In Vulnerability Note
Multiple Vulnerabilities in Microsoft Office
Original Issue Date:November 22, 2017
Severity Rating: HIGH
- Microsoft Excel 2007 SP 3
- Microsoft Excel 2010 SP 2 32-bit and 64-bit editions
- Microsoft Excel 2013 RT SP 1
- Microsoft Excel 2013 SP 1 32-bit and 64-bit editions
- Microsoft Excel 2016 32-bit and 64-bit editions
- Microsoft Excel 2016 Click-to-Run (C2R) for 32-bit and 64-bit editions
- Microsoft Excel 2016 for Mac
- Microsoft Excel Viewer 2007 SP 3
- Microsoft Office 2007 SP 3
- Microsoft Office 2010 SP 2 for 32-bit and 64-bit editions
- Microsoft Office 2013 SP 1 for 32-bit and 64-bit editions
- Microsoft Office 2016 for 32-bit and 64-bit editions
- Microsoft Office Compatibility Pack SP 3
- Microsoft Project Server 2013 SP 1
- Microsoft SharePoint Enterprise Server 2016
- Microsoft Word 2007 SP 3
- Microsoft Word 2010 SP 2 for 32-bit and 64-bit editions
Multiple vulnerabilities have been reported in Microsoft Office that could allow a remote attacker to execute arbitrary code and gain elevated privileges on the target system.
1. Microsoft Office Privilege Escalation Vulnerability
The vulnerability exists due to the improper handling of user sessions by the Microsoft Project Server. A remote attacker could exploit this vulnerability by hosting a specially crafted file on website and enticing a user to follow a malicious link to open that crafted file to conduct a cross-site request forgery (CSRF) attack. Successful exploitation of this vulnerability could allow the attacker to gain elevated privileged of the logged in user and perform action privileges on the target system.
2. Microsoft Office Security Bypass Vulnerability
The vulnerability exists in Microsoft Office due to the improper implementation of macro settings by the affected software. A remote attacker could exploit this vulnerability by enticing the user to open a specially crafted file with an affected version. Successful exploitation of this vulnerability could allow the attacker to bypass security features on the target system.
3. Microsoft Office Memory Corruption Vulnerabilities
These vulnerabilities exist in Microsoft Office software due to the improper handling of objects in memory. A remote attacker could exploit this vulnerability by hosting a specially crafted file on website and persuading a user to follow a malicious link to view the crafted file. Successful exploitation of this vulnerability could allow the attacker to execute arbitrary code in security context of the logged in user.
Apply appropriate software fixes as available on the vendor website.
The information provided herein is on "as is" basis, without warranty of any kind.
Email: firstname.lastname@example.org Phone: +91-11-24368572
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
6, CGO Complex, Lodhi Road,
New Delhi - 110 003