PT-2012-2375 · Microsoft · Works+1

Shaun Colley · Publicado 2012-04-10 · Atualizado 2018-10-12 · CVE-2012-0177

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Office versions prior to the fixed version Microsoft Works versions 6 through 9

Description A heap-based buffer overflow issue exists in the Office Works File Converter, allowing remote attackers to execute arbitrary code via a crafted Works file. This issue enables an attacker to take complete control of an affected system, potentially leading to the installation of programs, viewing, changing, or deleting data, or creating new accounts.

Recommendations For Microsoft Office 2007 SP2, update to a version that includes the fix for this issue. For Microsoft Works versions 6 through 9, consider disabling the Works File Converter until a patch is available. Restrict access to the Works File Converter to minimize the risk of exploitation.

Correção

RCE

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2012-0177

Produtos afetados

Office

Works

Referências · 11

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-028 · Aviso do Fabricante
• http://securityfocus.com/bid/52867 · Nota
• http://us-cert.gov/cas/techalerts/TA12-101A.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-0177 · Nota de Segurança
• http://osvdb.org/81134 · Nota
• http://secunia.com/advisories/48723 · Nota
• http://technet.microsoft.com/en-us/security/bulletin/ms12-028 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0177 · Nota de Segurança
• http://securitytracker.com/id?1026910 · Nota
• http://securitytracker.com/id?1026911 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15598 · Nota