PT-2017-1637 · Microsoft · Office Word+1

Published 2017-03-14 · Updated 2019-10-03 · CVE-2017-0029

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Office versions 2010 SP2 through 2016 Word versions 2010 SP2 through 2016

Description The issue is related to a denial of service vulnerability in Microsoft Office and Word, caused by insufficient access control. This vulnerability can be exploited by a remote attacker using a specially crafted Office document, leading to an application hang. The denial of service would not allow an attacker to execute code or elevate their user rights. For an attack to be successful, a user must open a specially crafted file with an affected version of Microsoft Office.

Recommendations For Microsoft Office 2010 SP2, update to a newer version to mitigate the risk. For Word 2010 SP2, update to a newer version to mitigate the risk. For Word 2013 RT SP1, update to a newer version to mitigate the risk. For Word 2016, update to a newer version to mitigate the risk. As a temporary workaround, consider avoiding the use of specially crafted files in the affected versions of Microsoft Office until a patch is available.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2017-00790

CVE-2017-0029

Affected Products

Office

Office Word

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2017-0029 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0029 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0029 · Security Note
• https://osv.dev/vulnerability/CVE-2017-0029 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-00790 · Security Note
• http://securityfocus.com/bid/96045 · Note
• http://technet.microsoft.com/library/security/MS17-014 · Note
• http://securitytracker.com/id/1038010 · Note