PT-2015-1063 · Microsoft · Sharepoint Server 2010+8

Published 2015-04-14 · Updated 2018-10-12 · CVE-2015-1649

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Word 2007 SP3 Microsoft Office 2010 SP2 Microsoft Word 2010 SP2 Microsoft Word Viewer Microsoft Office Compatibility Pack SP3 Microsoft Word Automation Services on SharePoint Server 2010 SP2 Microsoft Office Web Apps Server 2010 SP2

Description The issue is related to errors that occur due to the incorrect handling of specially crafted files. Exploitation of this issue may allow a remote attacker to execute arbitrary code with the privileges of the current user. This could potentially corrupt system memory, allowing an attacker to execute arbitrary code in the context of the current user. If the current user has administrative user rights, an attacker could take complete control of the affected system, install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Microsoft Word 2007 SP3, update to a newer version to mitigate the risk. For Microsoft Office 2010 SP2, update to a newer version to mitigate the risk. For Microsoft Word 2010 SP2, update to a newer version to mitigate the risk. For Microsoft Word Viewer, update to a newer version to mitigate the risk. For Microsoft Office Compatibility Pack SP3, update to a newer version to mitigate the risk. For Microsoft Word Automation Services on SharePoint Server 2010 SP2, update to a newer version to mitigate the risk. For Microsoft Office Web Apps Server 2010 SP2, update to a newer version to mitigate the risk. As a temporary workaround, consider avoiding the use of specially crafted files until a patch is available.

Fix

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2015-09920

BDU:2015-09921

BDU:2015-09922

BDU:2015-09923

CVE-2015-1649

Affected Products

Office 2010

Office Compatibility Pack

Office Web Apps Server 2010

Word 2007

Word 2010

Word Automation Services

Word Viewer

Office Word

Sharepoint Server 2010

References · 10

• https://bdu.fstec.ru/vul/2015-09923 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-1649 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-033 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09922 · Security Note
• https://bdu.fstec.ru/vul/2015-09920 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1649 · Security Note
• https://bdu.fstec.ru/vul/2015-09921 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1649 · Note
• http://technet.microsoft.com/security/bulletin/ms15-033 · Note
• http://securitytracker.com/id/1032104 · Note