PT-2018-9141 · Microsoft · Office+1

Tom Hoke · Published 2018-03-13 · Updated 2019-10-03 · CVE-2018-0907

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Microsoft Excel versions 2007 SP3 through 2016 Microsoft Office versions 2016 Click-to-Run and 2016 for Mac

Description: A security feature bypass issue exists due to how macro settings are enforced in Microsoft Office software, specifically affecting Excel documents. This issue does not allow arbitrary code execution on its own. To exploit this, an attacker would need to convince a user to open a specially crafted file with an affected version of Microsoft Office software.

Recommendations: For Microsoft Excel 2007 SP3, update to a version that enforces macro settings correctly. For Microsoft Excel 2010 SP2, update to a version that enforces macro settings correctly. For Microsoft Excel 2013 SP1, update to a version that enforces macro settings correctly. For Microsoft Excel 2016, update to a version that enforces macro settings correctly. For Microsoft Office 2016 Click-to-Run, update to a version that enforces macro settings correctly. For Microsoft Office 2016 for Mac, update to a version that enforces macro settings correctly.

Fix

Related Identifiers

CVE-2018-0907

Affected Products

Office Excel

Office

References · 6

• https://osv.dev/vulnerability/CVE-2018-0907 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0907 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0907 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-0907 · Security Note
• http://securityfocus.com/bid/103325 · Note
• http://securitytracker.com/id/1040524 · Note