PT-2017-1638 · Microsoft · Excel Services On Sharepoint Server+2

Published 2017-03-14 · Updated 2017-07-12 · CVE-2017-0027

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Excel versions 2007 SP3 through 2016 Office Compatibility Pack version SP3 Excel Services on SharePoint Server version 2013 SP1

Description The issue is related to the improper disclosure of memory contents by Microsoft Office, allowing remote attackers to obtain sensitive information from process memory via a crafted Office document. This could potentially be used to compromise the user's computer or data.

Recommendations For Microsoft Excel versions 2007 SP3 through 2016, update to a version that includes the fix for this issue. For Office Compatibility Pack version SP3, update to a version that includes the fix for this issue. For Excel Services on SharePoint Server version 2013 SP1, update to a version that includes the fix for this issue. As a temporary workaround, consider avoiding the use of crafted Office documents until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2017-00791

CVE-2017-0027

Affected Products

Excel Services On Sharepoint Server

Office Excel

Office Compatibility Pack

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2017-0027 · Security Note
• https://bdu.fstec.ru/vul/2017-00791 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0027 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0027 · Security Note
• https://osv.dev/vulnerability/CVE-2017-0027 · Vendor Advisory
• http://technet.microsoft.com/library/security/MS17-014 · Note
• http://securitytracker.com/id/1038010 · Note
• http://securityfocus.com/bid/96043 · Note