PT-2017-2413 · Microsoft · Office+1

Pedro Gallegos · Publicado 2017-06-13 · Atualizado 2019-10-03 · CVE-2017-8506

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Outlook (affected versions not specified) Microsoft Office (affected versions not specified)

Description The issue is related to improper data handling and input validation in Microsoft Office, which can lead to remote code execution. This could allow an attacker to gain control of an affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights. The exploitation requires convincing a user to open a specially crafted Office document.

Recommendations For Microsoft Outlook, update to a version that properly validates input before loading dynamic link library (DLL) files. For Microsoft Office, ensure that users are cautious when opening Office documents from untrusted sources, and consider restricting user rights on the system to minimize the impact of a potential exploit. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

BDU:2017-01616

CVE-2017-8506

Produtos afetados

Office

Outlook

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2017-8506 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8506 · Nota de Segurança
• https://bdu.fstec.ru/vul/2017-01616 · Nota de Segurança
• http://securityfocus.com/bid/98811 · Nota
• http://securitytracker.com/id/1038666 · Nota
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8506 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-8506 · Aviso do Fabricante