PT-2018-2090 · Microsoft · Windows+8

Publicado 2018-10-09 · Atualizado 2018-11-27 · CVE-2018-8427

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Office versions (affected versions not specified) Microsoft Office Word Viewer versions (affected versions not specified) Office 365 ProPlus versions (affected versions not specified) Windows Server 2008 versions (affected versions not specified) Microsoft PowerPoint Viewer versions (affected versions not specified) Microsoft Excel Viewer versions (affected versions not specified) Microsoft Office Compatibility Pack versions (affected versions not specified) Microsoft Windows versions (affected versions not specified)

Description An information disclosure issue exists in the way Microsoft Graphics Components handle objects in memory. This could allow an attacker to obtain sensitive information by exploiting the vulnerability, potentially using it for further exploitation. The vulnerability can be exploited when a user opens a specially crafted file.

Recommendations For Microsoft Office, update to a version that includes the fix for this issue. For Microsoft Office Word Viewer, consider disabling the handling of specially crafted files until a patch is available. For Office 365 ProPlus, restrict access to sensitive information to minimize the risk of exploitation. For Windows Server 2008, avoid using the affected Microsoft Graphics Components until the issue is resolved. For Microsoft PowerPoint Viewer, as a temporary workaround, consider disabling the opening of specially crafted files. For Microsoft Excel Viewer, update to a version that includes the fix for this issue. For Microsoft Office Compatibility Pack, restrict access to sensitive information to minimize the risk of exploitation. For Microsoft Windows, update to a version that includes the fix for this issue.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BDU:2019-00041

CVE-2018-8427

Produtos afetados

Excel Viewer

Graphics Components

Office

Office Compatibility Pack

Office Word Viewer

Powerpoint Viewer

Windows

Office 365 Proplus

Windows Server 2008

Referências · 8

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8427 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2018-8427 · Nota de Segurança
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8427 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-8427 · Aviso do Fabricante
• http://securityfocus.com/bid/105453 · Nota
• https://bdu.fstec.ru/vul/2019-00041 · Nota de Segurança
• http://securitytracker.com/id/1041823 · Nota
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2018-8427 · Aviso do Fabricante