PT-2007-7196 · Microsoft · Office

Published 2007-12-13 · Updated 2018-10-15 · CVE-2007-6329

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Office versions 12.0.6015.5000 through 12.0.6017.5000

Description The issue allows remote attackers to modify certain metadata fields in Office Open XML (OOXML) documents. This is demonstrated by the ability to alter the LastModifiedBy and creator fields in docProps/core.xml within the OOXML ZIP container.

Recommendations For versions 12.0.6015.5000 through 12.0.6017.5000, consider updating to a newer version that properly signs the metadata of OOXML documents to prevent unauthorized modifications.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2007-6329

Affected Products

Office

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2007-6329 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39021 · Note
• http://securityfocus.com/archive/1/484919/100/0/threaded · Note
• http://osvdb.org/44938 · Note
• http://securityfocus.com/bid/26833 · Note
• http://securityreason.com/securityalert/3443 · Note