PT-2016-2907 · Microsoft · Office Word+8

Publicado 2016-11-08 · Atualizado 2018-10-12 · CVE-2016-7233

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Office versions prior to the fixed version Office Compatibility Pack SP3 Word Automation Services on SharePoint Server 2013 SP1 Office Web Apps 2010 SP2 Word Viewer Word for Mac 2011 Excel for Mac 2011 Microsoft Word 2007 Office 2010 SP2 Word 2010 SP2

Description The issue is related to an uninitialized variable, causing out-of-bounds memory reading when Office or Word processes a specially crafted file. This could allow a remote attacker to obtain sensitive information from process memory or cause a denial of service. Exploitation requires a user to open a maliciously crafted file with an affected version of Microsoft Office software.

Recommendations For Microsoft Office versions prior to the fixed version, update to the latest version. For Office Compatibility Pack SP3, consider applying configuration changes to restrict the use of vulnerable components until a patch is available. For Word Automation Services on SharePoint Server 2013 SP1, restrict access to the service to minimize the risk of exploitation. For Office Web Apps 2010 SP2, avoid using the affected version until a patch is available. For Word Viewer, consider disabling the viewer until a patch is available. For Word for Mac 2011 and Excel for Mac 2011, update to a newer version or apply configuration changes to restrict the use of vulnerable components. For Microsoft Word 2007, Office 2010 SP2, and Word 2010 SP2, update to the latest version or apply configuration changes to restrict the use of vulnerable components.

Correção

DoS

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BDU:2016-02338

CVE-2016-7233

Produtos afetados

Excel For Mac

Office

Office Word

Office Compatibility Pack

Office Web Apps

Sharepoint Server

Word Automation Services

Word Viewer

Word For Mac

Referências · 8

• https://nvd.nist.gov/vuln/detail/CVE-2016-7233 · Nota de Segurança
• http://securityfocus.com/bid/94031 · Nota
• http://technet.microsoft.com/security/bulletin/MS16-133 · Nota
• https://bdu.fstec.ru/vul/2016-02338 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-133 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-7233 · Aviso do Fabricante
• http://securitytracker.com/id/1037246 · Nota
• https://verisign.com/en_US/security-services/security-intelligence/vulnerability-reports/articles/index.xhtml?id=1232 · Nota