PT-2014-7184 · Microsoft · Office Compatibility Pack+1

Publicado 2014-12-09 · Atualizado 2018-10-12 · CVE-2014-6356

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Word versions 2007 SP3 through 2010 SP2 Office Compatibility Pack version SP3

Description A remote code execution issue exists due to improper handling of objects in memory while parsing specially crafted Office files, potentially corrupting system memory and allowing an attacker to execute arbitrary code. This could enable an attacker to run arbitrary code in the context of the current user, potentially taking complete control of the affected system if the user has administrative rights.

Recommendations For Microsoft Word 2007 SP3, update to a version that properly handles objects in memory to prevent arbitrary code execution. For Microsoft Word 2010 SP2, apply the necessary patch to fix the improper handling of objects in memory. For Office Compatibility Pack SP3, ensure that the pack is updated to a version that correctly parses Office files without corrupting system memory.

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2014-6356

Produtos afetados

Office Word

Office Compatibility Pack

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2014-6356 · Nota de Segurança
• http://technet.microsoft.com/security/bulletin/ms14-081 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6356 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6356 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-081 · Aviso do Fabricante