PT-2013-3072 · Microsoft · Office For Mac+5

Will Dormann · CVE-2013-1315 · Publicado 2013-09-11 · Atualizado 2023-10-03

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server versions 2007 SP3, 2010 SP1 and SP2, and 2013 Office Web Apps 2010 Excel versions 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT Office for Mac 2011 Excel Viewer Office Compatibility Pack SP3

Description A remote code execution issue exists due to the way Microsoft Excel parses content in Excel files, potentially allowing an attacker to execute arbitrary code or cause a denial of service through memory corruption. This could enable an attacker to take complete control of an affected system, install programs, view, change, or delete data, or create new accounts with full user rights. The impact may be less severe for users with fewer user rights on the system compared to those operating with administrative user rights.

Recommendations For Microsoft SharePoint Server versions 2007 SP3, 2010 SP1 and SP2, and 2013, update to a version that includes the fix for this issue. For Office Web Apps 2010, update to a version that includes the fix for this issue. For Excel versions 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT, update to a version that includes the fix for this issue. For Office for Mac 2011, update to a version that includes the fix for this issue. For Excel Viewer, update to a version that includes the fix for this issue. For Office Compatibility Pack SP3, update to a version that includes the fix for this issue.

Exploit

Correção

RCE

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2013-1315

Produtos afetados

Office Excel

Excel Viewer

Sharepoint Server

Office Compatibility Pack

Office Web Apps

Office For Mac

Referências · 10

• 🔥 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18333 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1315 · Nota
• http://technet.microsoft.com/en-us/security/bulletin/ms13-073 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-1315 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-073 · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18950 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1315 · Nota de Segurança
• http://us-cert.gov/ncas/alerts/TA13-253A · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-067 · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18543 · Aviso do Fabricante