PT-2007-3116 · Microsoft · Office 2007 Publisher+1
Publicado
2007-07-10
·
Atualizado
2018-10-16
·
CVE-2007-1754
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
Microsoft Office Publisher 2007
Description:
The issue arises from improper memory clearing when transferring data from disk to memory, allowing remote attackers to execute arbitrary code via a malformed .pub page. This occurs due to a certain negative value that bypasses a sanitization procedure, which is supposed to initialize critical pointers to NULL. An attacker could exploit this by constructing a specially crafted Publisher (.pub) page, potentially allowing remote code execution and complete control of an affected system when a user views the .pub page.
Recommendations:
For Microsoft Office Publisher 2007, update to a version that properly clears memory resources when writing application data from disk to memory to prevent remote code execution. As a temporary workaround, consider avoiding the use of .pub pages from untrusted sources until a patch is available. Restrict access to .pub files to minimize the risk of exploitation.
Correção
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Office 2007 Publisher
Office Publisher