PT-2018-1076 · Microsoft · Outlook+2

Nicolas Joly · Published 2018-01-09 · Updated 2019-10-03 · CVE-2018-0793

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Outlook versions 2007 through 2013

Description A remote code execution issue exists due to the way Microsoft Outlook parses specially crafted email messages. This could allow a remote attacker to execute arbitrary code if a user opens a specially crafted file with an affected version of Microsoft Outlook. The exploitation of this issue requires a user to open a maliciously crafted file, potentially allowing the attacker to take control of the affected system, install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Microsoft Outlook 2007, update to a version that includes the fix for this issue. For Microsoft Outlook 2010, update to a version that includes the fix for this issue. For Microsoft Outlook 2013, update to a version that includes the fix for this issue. As a temporary workaround, consider avoiding the use of affected versions of Microsoft Outlook to parse email messages until a patch is available.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2018-00419

CVE-2018-0793

Affected Products

Outlook

Office

Office Word

References · 7

• https://osv.dev/vulnerability/CVE-2018-0793 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-0793 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0793 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0793 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-00419 · Security Note
• http://securityfocus.com/bid/102375 · Note
• http://securitytracker.com/id/1040154 · Note