PT-2016-1226 · Microsoft · Office Compatibility Pack+7

Published 2016-02-09 · Updated 2018-10-12 · CVE-2016-0054

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Excel versions 2007 SP3 through 2016 Microsoft Excel for Mac versions 2011 through 2016 Microsoft Office Compatibility Pack version SP3 Microsoft Excel Viewer Microsoft Excel Services on SharePoint Server versions 2007 SP3 through 2013 SP1 Microsoft Office Web Apps version 2010 SP2

Description The issue is caused by a buffer overflow in Microsoft Office software, allowing a remote attacker to execute arbitrary code via a specially crafted document. This occurs when the Office software fails to properly handle objects in memory. An attacker who successfully exploits the issue could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system, install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Microsoft Excel versions 2007 SP3 through 2016, update to a newer version that contains a fix for this issue. For Microsoft Excel for Mac versions 2011 through 2016, update to a newer version that contains a fix for this issue. For Microsoft Office Compatibility Pack version SP3, update to a newer version that contains a fix for this issue. For Microsoft Excel Viewer, update to a newer version that contains a fix for this issue. For Microsoft Excel Services on SharePoint Server versions 2007 SP3 through 2013 SP1, update to a newer version that contains a fix for this issue. For Microsoft Office Web Apps version 2010 SP2, update to a newer version that contains a fix for this issue.

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2016-00487

CVE-2016-0054

Affected Products

Office Excel

Excel Services

Excel Viewer

Excel For Mac

Office Compatibility Pack

Office Web Apps

Office

Sharepoint Server

References · 8

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-015 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-0054 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-0054 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0054 · Security Note
• https://bdu.fstec.ru/vul/2016-00487 · Security Note
• http://securitytracker.com/id/1034976 · Note
• http://technet.microsoft.com/security/bulletin/ms16-015 · Note
• http://technet.microsoft.com/security/bulletin/MS16-015 · Note