PT-2018-1076 · Microsoft · Outlook+2

Nicolas Joly · Publicado 2018-01-09 · Atualizado 2019-10-03 · CVE-2018-0793

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Outlook versions 2007 through 2013

Description A remote code execution issue exists due to the way Microsoft Outlook parses specially crafted email messages. This could allow a remote attacker to execute arbitrary code if a user opens a specially crafted file with an affected version of Microsoft Outlook. The exploitation of this issue requires a user to open a maliciously crafted file, potentially allowing the attacker to take control of the affected system, install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Microsoft Outlook 2007, update to a version that includes the fix for this issue. For Microsoft Outlook 2010, update to a version that includes the fix for this issue. For Microsoft Outlook 2013, update to a version that includes the fix for this issue. As a temporary workaround, consider avoiding the use of affected versions of Microsoft Outlook to parse email messages until a patch is available.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2018-00419

CVE-2018-0793

Produtos afetados

Outlook

Office

Office Word

Referências · 7

• https://osv.dev/vulnerability/CVE-2018-0793 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-0793 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0793 · Nota de Segurança
• http://securityfocus.com/bid/102375 · Nota
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0793 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2018-00419 · Nota de Segurança
• http://securitytracker.com/id/1040154 · Nota