PT-2013-1366 · Microsoft · Office 2007+8

Sinn3R · Published 2013-11-05 · Updated 2025-04-07 · CVE-2013-3906

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows Vista SP2 Microsoft Windows Server 2008 SP2 Microsoft Office 2003 SP3 Microsoft Office 2007 SP3 Microsoft Office 2010 SP1 and SP2 Microsoft Office Compatibility Pack SP3 Microsoft Lync 2010, 2010 Attendee, 2013, and Basic 2013

Description A remote code execution issue exists in the way affected Microsoft components handle specially crafted TIFF files. This could allow remote attackers to execute arbitrary code via a crafted TIFF image, as demonstrated by an image in a Word document. The issue has been exploited in the wild. An attacker who successfully exploits this issue could take complete control of an affected system, allowing them to install programs, view, change, or delete data, or create new accounts with full administrative rights.

Recommendations For Microsoft Windows Vista SP2, update to a newer version that contains a fix for this issue. For Microsoft Windows Server 2008 SP2, update to a newer version that contains a fix for this issue. For Microsoft Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2, update to a newer version that contains a fix for this issue. For Microsoft Office Compatibility Pack SP3, update to a newer version that contains a fix for this issue. For Microsoft Lync 2010, 2010 Attendee, 2013, and Basic 2013, update to a newer version that contains a fix for this issue. As a temporary workaround, consider avoiding the use of TIFF files from untrusted sources until a patch is available.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2023-00594

CVE-2013-3906

Affected Products

Lync

Office

Office 2003

Office 2007

Office 2010

Office Compatibility Pack

Windows

Windows Server 2008

Windows Vista

References · 20

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/mswin_tiff_overflow.rb · Exploit
• 🔥 http://exploit-db.com/exploits/30011 · Exploit
• 🔥 http://blogs.mcafee.com/mcafee-labs/mcafee-labs-detects-zero-day-exploit-targeting-microsoft-office-2 · Exploit
• 🔥 http://blogs.technet.com/b/srd/archive/2013/11/05/cve-2013-3906-a-graphics-vulnerability-exploited-through-word-documents.aspx · Exploit
• 🔥 https://exploit-db.com/exploits/30011 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3906 · Security Note
• http://technet.microsoft.com/security/advisory/2896666 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-3906 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-096 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00594 · Security Note
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog · Note
• https://t.me/nekaspersky/1796 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-3906 · Note
• https://t.me/cvenotify/104954 · Telegram Post