PT-2016-2904 · Microsoft · Excel Services On Sharepoint Server+4

Published 2016-11-08 · Updated 2018-10-12 · CVE-2016-7236

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Excel versions 2010 SP2 Excel for Mac versions 2011 Excel 2016 for Mac Excel Services on SharePoint Server versions 2010 SP2

Description The issue is caused by a buffer overflow in memory, allowing a remote attacker to execute arbitrary code using a specially crafted document. Exploitation of the issue requires a user to open a specially crafted file with an affected version of Microsoft Office software. If successfully exploited, an attacker could run arbitrary code in the context of the current user, potentially taking control of the affected system, installing programs, viewing, changing, or deleting data, or creating new accounts with full user rights.

Recommendations For Microsoft Excel 2010 SP2, consider disabling the ability to open specially crafted documents until a patch is available. For Excel for Mac 2011, restrict access to opening untrusted files to minimize the risk of exploitation. For Excel 2016 for Mac, avoid using the software to open documents from untrusted sources until the issue is resolved. For Excel Services on SharePoint Server 2010 SP2, consider implementing additional security measures to restrict the upload and opening of specially crafted files. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2016-02335

CVE-2016-7236

Affected Products

Excel Services On Sharepoint Server

Excel For Mac

Office Excel

Office

Sharepoint Server

References · 10

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7236 · Security Note
• https://osv.dev/vulnerability/CVE-2016-7236 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-02335 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-133 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-7236 · Security Note
• https://verisign.com/en_US/security-services/security-intelligence/vulnerability-reports/articles/index.xhtml?id=1235 · Note
• http://technet.microsoft.com/library/security/MS16-133 · Note
• http://technet.microsoft.com/security/bulletin/MS16-133 · Note
• http://securityfocus.com/bid/94025 · Note
• http://securitytracker.com/id/1037246 · Note