PT-2016-2767 · Microsoft · Office

Published 2016-09-13 · Updated 2018-10-12 · CVE-2016-0141

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Office versions 2007 SP3 through 2016

Description The issue is related to Visual Basic macros in Microsoft Office, which improperly export a user's private key from the certificate store during a document-save operation. This could allow a remote attacker to obtain sensitive information via unspecified vectors. An attacker who successfully exploits the issue could potentially gain access to the user's private key, although they would need to use another vulnerability or employ a social engineering technique to obtain the saved document from the user.

Recommendations For Microsoft Office 2007 SP3, consider disabling the use of Visual Basic macros until a patch is available. For Microsoft Office 2010 SP2, restrict access to sensitive documents to minimize the risk of exploitation. For Microsoft Office 2013 SP1, avoid using the certificate store for sensitive information until the issue is resolved. For Microsoft Office 2016, apply configuration changes to limit the export of private keys from the certificate store.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2016-02169

CVE-2016-0141

Affected Products

Office

References · 9

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-107 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0141 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-0141 · Security Note
• https://osv.dev/vulnerability/CVE-2016-0141 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-02169 · Security Note
• http://technet.microsoft.com/security/bulletin/MS16-107 · Note
• http://securityfocus.com/bid/92903 · Note
• http://technet.microsoft.com/library/security/MS16-107 · Note
• http://securitytracker.com/id/1036785 · Note