PT-2015-5739 · Microsoft · Visio 2013+29

Published 2015-08-11 · Updated 2019-05-15 · CVE-2015-2423

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Windows 10 Excel 2007 SP3, PowerPoint 2007 SP3, Visio 2007 SP3, Word 2007 SP3 Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Visio 2010 SP2, Word 2010 SP2 Excel 2013 SP1, PowerPoint 2013 SP1, Visio 2013 SP1, Word 2013 SP1 Excel 2013 RT SP1, PowerPoint 2013 RT SP1, Visio 2013 RT SP1, Word 2013 RT SP1 Internet Explorer 7 through 11

Description An information disclosure issue exists in Microsoft Windows, Internet Explorer, and Microsoft Office when files at a medium integrity level become accessible to Internet Explorer running in Enhanced Protection Mode (EPM). To exploit this issue, an attacker would first need to leverage another vulnerability and execute code in Internet Explorer with EPM, and then execute Excel, Notepad, PowerPoint, Visio, or Word using an unsafe command line parameter. This allows remote attackers to gain privileges and obtain sensitive information.

Recommendations For Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Windows 10, consider restricting access to sensitive files and directories to minimize the risk of exploitation. For Excel 2007 SP3, PowerPoint 2007 SP3, Visio 2007 SP3, Word 2007 SP3, Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Visio 2010 SP2, Word 2010 SP2, Excel 2013 SP1, PowerPoint 2013 SP1, Visio 2013 SP1, Word 2013 SP1, Excel 2013 RT SP1, PowerPoint 2013 RT SP1, Visio 2013 RT SP1, Word 2013 RT SP1, avoid using unsafe command line parameters when executing these applications. For Internet Explorer 7 through 11, consider disabling Enhanced Protection Mode (EPM) until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2015-2423

Affected Products

Excel 2007

Excel 2010

Excel 2013

Excel 2013 Rt

Internet Explorer

Office 2010

Office Excel

Office Powerpoint

Office Visio

Office Word

Powerpoint 2007

Powerpoint 2010

Powerpoint 2013 Rt

Visio 2007

Visio 2010

Visio 2013

Visio 2013 Rt

Windows

Windows 10

Windows 7

Windows 8

Windows 8.1

Windows Rt

Windows Server 2008

Windows Server 2012

Windows Vista

Word 2007

Word 2010

Word 2013

Word 2013 Rt

References · 12

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-079 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-088 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-081 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2423 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-2423 · Security Note
• http://technet.microsoft.com/security/bulletin/ms15-088 · Note
• http://securitytracker.com/id/1033237 · Note
• http://technet.microsoft.com/security/bulletin/ms15-079 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2423 · Note
• http://securitytracker.com/id/1033248 · Note
• http://securitytracker.com/id/1033239 · Note
• http://technet.microsoft.com/security/bulletin/ms15-081 · Note