PT-2018-2112 · Microsoft · Office 365 Proplus+2

Yonghui Han · Publicado 2018-12-11 · Atualizado 2020-08-24 · CVE-2018-8587

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Outlook versions prior to the fixed version Office 365 ProPlus (affected versions not specified) Microsoft Office (affected versions not specified)

Description The issue is related to errors in the mechanisms for handling objects in memory. Exploitation of this issue may allow an attacker to execute arbitrary code with the privileges of the current user using specially crafted content. To exploit the issue, a user must open a specially crafted file with an affected version of Microsoft Outlook software. The Preview Pane is not an attack vector for this issue.

Recommendations For Microsoft Outlook, update to a version that includes the fix for this issue. For Office 365 ProPlus, apply the recommended configuration changes to minimize the risk of exploitation. For Microsoft Office, consider restricting access to specially crafted files until a patch is available. As a temporary workaround, consider disabling the handling of specially crafted files in Microsoft Outlook until a patch is available.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

BDU:2019-00063

CVE-2018-8587

Produtos afetados

Office

Outlook

Office 365 Proplus

Referências · 6

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8587 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2018-8587 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-8587 · Aviso do Fabricante
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8587 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-00063 · Nota de Segurança
• http://securityfocus.com/bid/106097 · Nota