PT-2015-2329 · Microsoft · Excel For Mac+6

Published 2015-10-13 · Updated 2018-10-12 · CVE-2015-2558

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Excel versions 2007 SP3 through 2016 Microsoft Excel for Mac versions 2011 through 2016 Microsoft Excel Viewer (affected versions not specified) Microsoft Office Compatibility Pack version SP3 Microsoft Excel Services on SharePoint Server versions 2007 SP3 through 2013 SP1

Description A use-after-free issue in Microsoft Office software allows remote attackers to execute arbitrary code via a long fileVersion element in an Office document. This occurs when the Office software fails to properly handle objects in memory. An attacker who successfully exploits this issue could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system, then install programs, view, change, or delete data, or create new accounts with full user rights. Exploitation requires that a user open a specially crafted file with an affected version of Microsoft Office software.

Recommendations For Microsoft Excel versions 2007 SP3 through 2016, update to a version that includes the fix for this issue. For Microsoft Excel for Mac versions 2011 through 2016, update to a version that includes the fix for this issue. For Microsoft Excel Viewer, at the moment, there is no information about a newer version that contains a fix for this issue. For Microsoft Office Compatibility Pack version SP3, update to a version that includes the fix for this issue. For Microsoft Excel Services on SharePoint Server versions 2007 SP3 through 2013 SP1, update to a version that includes the fix for this issue. As a temporary workaround, consider avoiding the use of the fileVersion element in Office documents until a patch is available.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2015-11694

CVE-2015-2558

ZDI-15-516

Affected Products

Office Excel

Excel Services

Excel Viewer

Excel For Mac

Office Compatibility Pack

Office

Sharepoint Server

References · 10

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2558 · Security Note
• https://bdu.fstec.ru/vul/2015-11694 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-110 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-15-516 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-2558 · Security Note
• http://zerodayinitiative.com/advisories/ZDI-15-516 · Note
• http://technet.microsoft.com/security/bulletin/MS15-110 · Note
• http://securitytracker.com/id/1033803 · Note
• http://technet.microsoft.com/security/bulletin/ms15-110 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2558 · Note