PT-2013-3072 · Microsoft · Office For Mac+5

Will Dormann · Published 2013-09-11 · Updated 2023-10-03 · CVE-2013-1315

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server versions 2007 SP3, 2010 SP1 and SP2, and 2013 Office Web Apps 2010 Excel versions 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT Office for Mac 2011 Excel Viewer Office Compatibility Pack SP3

Description A remote code execution issue exists due to the way Microsoft Excel parses content in Excel files, potentially allowing an attacker to execute arbitrary code or cause a denial of service through memory corruption. This could enable an attacker to take complete control of an affected system, install programs, view, change, or delete data, or create new accounts with full user rights. The impact may be less severe for users with fewer user rights on the system compared to those operating with administrative user rights.

Recommendations For Microsoft SharePoint Server versions 2007 SP3, 2010 SP1 and SP2, and 2013, update to a version that includes the fix for this issue. For Office Web Apps 2010, update to a version that includes the fix for this issue. For Excel versions 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT, update to a version that includes the fix for this issue. For Office for Mac 2011, update to a version that includes the fix for this issue. For Excel Viewer, update to a version that includes the fix for this issue. For Office Compatibility Pack SP3, update to a version that includes the fix for this issue.

Exploit

Fix

RCE

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2013-1315

Affected Products

Office Excel

Excel Viewer

Sharepoint Server

Office Compatibility Pack

Office Web Apps

Office For Mac

References · 10

• 🔥 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18333 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-1315 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-073 · Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18950 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1315 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-067 · Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18543 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1315 · Note
• http://technet.microsoft.com/en-us/security/bulletin/ms13-073 · Note
• http://us-cert.gov/ncas/alerts/TA13-253A · Note