PT-2014-1001 · Microsoft · Office Word

Yuhong Bao · Published 2014-04-08 · Updated 2018-10-12 · CVE-2014-1758

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Word version 2003 SP3

Description The issue is related to a stack-based buffer overflow that allows remote attackers to execute arbitrary code via a crafted document. This occurs due to insufficient checking of user input data, which can lead to a buffer overflow, resulting in denial of service or allowing the execution of arbitrary code. A remote code execution issue exists in the way Microsoft Word parses specially crafted files, potentially allowing an attacker to run arbitrary code as the current user. If the current user has administrative rights, an attacker could gain complete control of the affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Microsoft Word 2003 SP3, consider avoiding the use of crafted documents that could trigger the buffer overflow until a patch is available. As a temporary workaround, restrict the opening of files from untrusted sources to minimize the risk of exploitation.

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2014-00009

CVE-2014-1758

Affected Products

Office Word

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2014-1758 · Security Note
• https://bdu.fstec.ru/vul/2014-00009 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-017 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1758 · Security Note
• http://technet.microsoft.com/en-us/security/bulletin/ms14-017 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1758 · Note
• http://support.microsoft.com/default.aspx?scid=kb;EN-US;2863907 · Note