PT-2011-3522 · Microsoft · Office

David Warren · Publicado 2011-09-15 · Atualizado 2018-10-12 · CVE-2011-1982

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Office versions 2007 SP2, 2010 Gold, and 2010 SP1

Description A remote code execution issue exists in the way Microsoft Office handles specially crafted Word files. This allows remote attackers to execute arbitrary code via a crafted document. An attacker who successfully exploits this issue could take complete control of an affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Microsoft Office 2007 SP2, consider applying the necessary security updates to resolve the issue. For Microsoft Office 2010 Gold, apply the relevant security patch to fix the vulnerability. For Microsoft Office 2010 SP1, update to a version that includes the security fix for this issue.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2011-1982

Produtos afetados

Office

Referências · 7

• http://kb.cert.org/vuls/id/909022 · Nota
• http://us-cert.gov/cas/techalerts/TA11-256A.html · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12243 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1982 · Nota de Segurança
• http://technet.microsoft.com/en-us/security/bulletin/MS11-073 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-1982 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-073 · Aviso do Fabricante