PT-2013-4189 · Microsoft · Office Compatibility Pack+2

Aleksey Osipov + 3 · Published 2013-09-11 · Updated 2018-10-12 · CVE-2013-3159

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Excel versions 2003 SP3, 2007 SP3, and 2010 SP1 and SP2 Excel Viewer Microsoft Office Compatibility Pack version SP3

Description An issue exists in the way Microsoft Excel parses specially crafted XML files, allowing remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference. This is related to an XML External Entity (XXE) issue, which is an information disclosure vulnerability.

Recommendations For Microsoft Excel versions 2003 SP3, 2007 SP3, and 2010 SP1 and SP2, consider disabling the parsing of external entities in XML files until a patch is available. For Excel Viewer, restrict access to specially crafted XML files to minimize the risk of exploitation. For Microsoft Office Compatibility Pack version SP3, avoid using the affected XML parsing functionality until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2013-3159

Affected Products

Excel Viewer

Office Excel

Office Compatibility Pack

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2013-3159 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-073 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3159 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3159 · Note
• http://technet.microsoft.com/en-us/security/bulletin/ms13-073 · Note
• http://securitylab.ru/lab/PT-2013-72 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18686 · Note
• http://us-cert.gov/ncas/alerts/TA13-253A · Note