PT-2014-1205 · Microsoft · Mscomctl+5
Publicado
2014-05-13
·
Atualizado
2018-10-30
·
CVE-2014-1809
CVSS v2.0
6.8
Média
| Vetor | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Microsoft Office 2007 version SP3
Microsoft Office 2010 versions SP1 through SP2
Microsoft Office 2013 versions Gold through RT SP1
Description
The MSCOMCTL library in Microsoft Office does not properly implement Address Space Layout Randomization (ASLR), making it easier for remote attackers to bypass the ASLR protection mechanism. This issue has been exploited in the wild. The security feature bypass by itself does not allow arbitrary code execution, but an attacker could use this ASLR bypass vulnerability in conjunction with another vulnerability to run arbitrary code.
Recommendations
For Microsoft Office 2007 version SP3, update to a newer version to mitigate the risk.
For Microsoft Office 2010 versions SP1 through SP2, update to a newer version to mitigate the risk.
For Microsoft Office 2013 versions Gold through RT SP1, update to a newer version to mitigate the risk.
As a temporary workaround, consider restricting access to the MSCOMCTL library until a patch is available.
Correção
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Mscomctl
Office 2007
Office 2010
Office 2013
Office
Office Project