PT-2019-3189 · Microsoft · Office Project+2

Publicado 2019-09-10 · Atualizado 2019-09-12 · CVE-2019-1264

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Office (affected versions not specified) Office 365 (affected versions not specified) Microsoft Project (affected versions not specified)

Description A security feature bypass issue exists due to improper handling of input in Microsoft Office, allowing an attacker to execute arbitrary commands by exploiting the vulnerability. The vulnerability can be exploited through a specially crafted file.

Recommendations For Microsoft Office, consider implementing additional input validation mechanisms until a patch is available. For Office 365, restrict access to potentially vulnerable features to minimize the risk of exploitation. For Microsoft Project, avoid using potentially vulnerable functions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2019-03178

CVE-2019-1264

Produtos afetados

Office

Office Project

Office 365

Referências · 5

• https://bdu.fstec.ru/vul/2019-03178 · Nota de Segurança
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1264 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-1264 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-1264 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1264 · Nota de Segurança