PT-2018-1077 · Microsoft · Word 2016+3

Debasish Mandal · Published 2018-01-09 · Updated 2020-08-24 · CVE-2018-0792

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Office 2016 Microsoft Word 2016 in Microsoft Office 2016

Description The issue is related to the improper handling of objects in memory, which can allow a remote attacker to execute arbitrary code by using a specially crafted file. If the current user is logged on with administrative user rights, an attacker could take control of the affected system, install programs, view, change, or delete data, or create new accounts with full user rights. Users with fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Recommendations For Microsoft Office 2016, consider avoiding the use of specially crafted files until a patch is available. For Microsoft Word 2016 in Microsoft Office 2016, as a temporary workaround, consider restricting the opening of files from untrusted sources until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-119

Related Identifiers

BDU:2018-00420

CVE-2018-0792

Affected Products

Office 2016

Word 2016

Office Word

Sharepoint Server

References · 7

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0792 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-0792 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-0792 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0792 · Security Note
• https://bdu.fstec.ru/vul/2018-00420 · Security Note
• http://securityfocus.com/bid/102381 · Note
• http://securitytracker.com/id/1040153 · Note