PT-2017-2005 · Microsoft · Outlook+1

Ryan Hanson + 1 · Publicado 2017-04-11 · Atualizado 2017-07-11 · CVE-2017-0106

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Outlook versions 2007 through 2016 Microsoft Excel version 2007 SP3

Description The issue is caused by a buffer overflow in memory, allowing a remote attacker to execute arbitrary code or cause a denial of service (memory corruption) by using a specially crafted document or email message. An attacker who successfully exploits this vulnerability could take control of an affected system, then install programs, view, change, or delete data, or create new accounts with full user rights. Exploitation requires a user to open or preview a specially crafted email message with an affected version of Microsoft Outlook.

Recommendations For Microsoft Outlook versions 2007 through 2016, update to a version that is not affected by this issue. For Microsoft Excel version 2007 SP3, avoid using the affected software until a patch is available. As a temporary workaround, consider avoiding the use of specially crafted documents or email messages until a patch is available.

Correção

RCE

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

BDU:2017-01171

CVE-2017-0106

Produtos afetados

Office Excel

Outlook

Referências · 7

• http://securitytracker.com/id/1038227 · Nota
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0106 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-0106 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0106 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-0106 · Aviso do Fabricante
• http://securityfocus.com/bid/97413 · Nota
• https://bdu.fstec.ru/vul/2017-01171 · Nota de Segurança