PT-2014-1681 · Microsoft · Office Publisher

Published 2014-04-08 · Updated 2018-10-12 · CVE-2014-1759

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Publisher versions 2003 SP3 through 2007 SP3

Description A remote code execution issue exists in Microsoft Publisher, related to the processing of specially crafted files. This allows an attacker to execute arbitrary code with the privileges of the current user. If the logged-on user has administrative rights, the attacker could gain complete control over the system, enabling them to install programs, view, change, or delete data, and create new accounts with full user rights.

Recommendations For Microsoft Publisher version 2003 SP3, update to a newer version to mitigate the risk. For Microsoft Publisher version 2007 SP3, update to a newer version to mitigate the risk. As a temporary workaround, consider avoiding the use of specially crafted .pub files until a patch is available.

Fix

Related Identifiers

BDU:2015-00625

CVE-2014-1759

Affected Products

Office Publisher

References · 6

• https://bdu.fstec.ru/vul/2015-00625 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-1759 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1759 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-020 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1759 · Note
• http://technet.microsoft.com/en-us/security/bulletin/ms14-020 · Note