PT-2020-3201 · Microsoft · Sharepoint Server+2

Published 2020-07-14 · Updated 2021-07-21 · CVE-2020-1446

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Word (affected versions not specified) Microsoft Office (affected versions not specified) Microsoft SharePoint (affected versions not specified)

Description The issue is related to the incorrect handling of objects in memory, which can be exploited by a remote attacker to execute arbitrary code using a specially crafted file. To exploit the issue, a user must open the specially crafted file with an affected version of the software. This can allow the attacker to perform actions in the security context of the current user.

Recommendations For Microsoft Word, to resolve the issue, update to a version that properly handles objects in memory. For Microsoft Office, consider restricting the use of Microsoft Word until a patch is available. For Microsoft SharePoint, as a temporary workaround, consider disabling the ability to open specially crafted files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2020-03499

CVE-2020-1446

Affected Products

Office

Sharepoint Server

Office Word

References · 8

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1446 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1446 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-03499 · Security Note
• https://osv.dev/vulnerability/CVE-2020-1446 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1446 · Security Note
• https://t.me/cvenotify/5021 · Telegram Post
• https://t.me/cvenotify/5020 · Telegram Post
• https://t.me/cvenotify/5019 · Telegram Post