PT-2016-1226 · Microsoft · Office Compatibility Pack+7

Publicado 2016-02-09 · Atualizado 2018-10-12 · CVE-2016-0054

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Excel versions 2007 SP3 through 2016 Microsoft Excel for Mac versions 2011 through 2016 Microsoft Office Compatibility Pack version SP3 Microsoft Excel Viewer Microsoft Excel Services on SharePoint Server versions 2007 SP3 through 2013 SP1 Microsoft Office Web Apps version 2010 SP2

Description The issue is caused by a buffer overflow in Microsoft Office software, allowing a remote attacker to execute arbitrary code via a specially crafted document. This occurs when the Office software fails to properly handle objects in memory. An attacker who successfully exploits the issue could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system, install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Microsoft Excel versions 2007 SP3 through 2016, update to a newer version that contains a fix for this issue. For Microsoft Excel for Mac versions 2011 through 2016, update to a newer version that contains a fix for this issue. For Microsoft Office Compatibility Pack version SP3, update to a newer version that contains a fix for this issue. For Microsoft Excel Viewer, update to a newer version that contains a fix for this issue. For Microsoft Excel Services on SharePoint Server versions 2007 SP3 through 2013 SP1, update to a newer version that contains a fix for this issue. For Microsoft Office Web Apps version 2010 SP2, update to a newer version that contains a fix for this issue.

Correção

RCE

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

BDU:2016-00487

CVE-2016-0054

Produtos afetados

Office Excel

Excel Services

Excel Viewer

Excel For Mac

Office Compatibility Pack

Office Web Apps

Office

Sharepoint Server

Referências · 8

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-015 · Aviso do Fabricante
• http://securitytracker.com/id/1034976 · Nota
• https://osv.dev/vulnerability/CVE-2016-0054 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-0054 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0054 · Nota de Segurança
• http://technet.microsoft.com/security/bulletin/ms16-015 · Nota
• http://technet.microsoft.com/security/bulletin/MS16-015 · Nota
• https://bdu.fstec.ru/vul/2016-00487 · Nota de Segurança