PT-2014-1205 · Microsoft · Mscomctl+5

Published 2014-05-13 · Updated 2018-10-30 · CVE-2014-1809

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Office 2007 version SP3 Microsoft Office 2010 versions SP1 through SP2 Microsoft Office 2013 versions Gold through RT SP1

Description The MSCOMCTL library in Microsoft Office does not properly implement Address Space Layout Randomization (ASLR), making it easier for remote attackers to bypass the ASLR protection mechanism. This issue has been exploited in the wild. The security feature bypass by itself does not allow arbitrary code execution, but an attacker could use this ASLR bypass vulnerability in conjunction with another vulnerability to run arbitrary code.

Recommendations For Microsoft Office 2007 version SP3, update to a newer version to mitigate the risk. For Microsoft Office 2010 versions SP1 through SP2, update to a newer version to mitigate the risk. For Microsoft Office 2013 versions Gold through RT SP1, update to a newer version to mitigate the risk. As a temporary workaround, consider restricting access to the MSCOMCTL library until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2014-00364

CVE-2014-1809

Affected Products

Mscomctl

Office 2007

Office 2010

Office 2013

Office

Office Project

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2014-1809 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-024 · Vendor Advisory
• https://bdu.fstec.ru/vul/2014-00364 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1809 · Security Note
• http://technet.microsoft.com/ru-ru/security/bulletin/ms14-024 · Note
• http://technet.microsoft.com/en-us/security/bulletin/ms14-024 · Note