PT-2014-1681 · Microsoft · Office Publisher

Publicado 2014-04-08 · Atualizado 2018-10-12 · CVE-2014-1759

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Publisher versions 2003 SP3 through 2007 SP3

Description A remote code execution issue exists in Microsoft Publisher, related to the processing of specially crafted files. This allows an attacker to execute arbitrary code with the privileges of the current user. If the logged-on user has administrative rights, the attacker could gain complete control over the system, enabling them to install programs, view, change, or delete data, and create new accounts with full user rights.

Recommendations For Microsoft Publisher version 2003 SP3, update to a newer version to mitigate the risk. For Microsoft Publisher version 2007 SP3, update to a newer version to mitigate the risk. As a temporary workaround, consider avoiding the use of specially crafted .pub files until a patch is available.

Correção

Identificadores relacionados

BDU:2015-00625

CVE-2014-1759

Produtos afetados

Office Publisher

Referências · 6

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1759 · Nota
• https://bdu.fstec.ru/vul/2015-00625 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2014-1759 · Nota de Segurança
• http://technet.microsoft.com/en-us/security/bulletin/ms14-020 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1759 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-020 · Aviso do Fabricante