PT-2017-2413 · Microsoft · Office+1

Pedro Gallegos · Published 2017-06-13 · Updated 2019-10-03 · CVE-2017-8506

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Outlook (affected versions not specified) Microsoft Office (affected versions not specified)

Description The issue is related to improper data handling and input validation in Microsoft Office, which can lead to remote code execution. This could allow an attacker to gain control of an affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights. The exploitation requires convincing a user to open a specially crafted Office document.

Recommendations For Microsoft Outlook, update to a version that properly validates input before loading dynamic link library (DLL) files. For Microsoft Office, ensure that users are cautious when opening Office documents from untrusted sources, and consider restricting user rights on the system to minimize the impact of a potential exploit. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2017-01616

CVE-2017-8506

Affected Products

Office

Outlook

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2017-8506 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8506 · Security Note
• https://bdu.fstec.ru/vul/2017-01616 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8506 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-8506 · Vendor Advisory
• http://securityfocus.com/bid/98811 · Note
• http://securitytracker.com/id/1038666 · Note