PT-2011-3522 · Microsoft · Office

David Warren · Published 2011-09-15 · Updated 2018-10-12 · CVE-2011-1982

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Office versions 2007 SP2, 2010 Gold, and 2010 SP1

Description A remote code execution issue exists in the way Microsoft Office handles specially crafted Word files. This allows remote attackers to execute arbitrary code via a crafted document. An attacker who successfully exploits this issue could take complete control of an affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Microsoft Office 2007 SP2, consider applying the necessary security updates to resolve the issue. For Microsoft Office 2010 Gold, apply the relevant security patch to fix the vulnerability. For Microsoft Office 2010 SP1, update to a version that includes the security fix for this issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2011-1982

Affected Products

Office

References · 7

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1982 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2011-1982 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-073 · Vendor Advisory
• http://kb.cert.org/vuls/id/909022 · Note
• http://us-cert.gov/cas/techalerts/TA11-256A.html · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12243 · Note
• http://technet.microsoft.com/en-us/security/bulletin/MS11-073 · Note