PT-2017-1656 · Microsoft · Office Compatibility Pack+3

Published 2017-03-17 · Updated 2017-07-12 · CVE-2017-0006

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Office Compatibility Pack (affected versions not specified) Microsoft Excel (affected versions not specified) Microsoft SharePoint Server (affected versions not specified) Microsoft Excel Viewer (affected versions not specified)

Description The issue is caused by a buffer overflow in memory, allowing a remote attacker to execute arbitrary code or cause a denial of service (memory corruption) by using a specially crafted document.

Recommendations For Microsoft Office Compatibility Pack, update to a version that includes a fix for the buffer overflow issue. For Microsoft Excel, update to a version that includes a fix for the buffer overflow issue. For Microsoft SharePoint Server, update to a version that includes a fix for the buffer overflow issue. For Microsoft Excel Viewer, update to a version that includes a fix for the buffer overflow issue. As a temporary workaround, consider avoiding the use of specially crafted documents until a patch is available.

Fix

RCE

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2017-00809

CVE-2017-0006

Affected Products

Office Excel

Excel Viewer

Office Compatibility Pack

Sharepoint Server

References · 6

• https://osv.dev/vulnerability/CVE-2017-0006 · Vendor Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0006 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-0006 · Security Note
• https://bdu.fstec.ru/vul/2017-00809 · Security Note
• http://securityfocus.com/bid/96740 · Note
• http://securitytracker.com/id/1038010 · Note