PT-2021-3041 · Microsoft · Office+3

Kdot · Published 2021-05-11 · Updated 2023-12-29 · CVE-2021-31177

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Office (affected versions not specified) Microsoft 365 Apps for Enterprise (affected versions not specified) Microsoft Excel (affected versions not specified) Microsoft Office Web Apps Server (affected versions not specified)

Description The issue is related to the use of memory after it has been freed, which can be exploited by a remote attacker to execute arbitrary code using a specially crafted file. This can occur through the parsing of Microsoft Excel XLS files. The vulnerability allows remote attackers to execute arbitrary code.

Recommendations For Microsoft Office, consider restricting the use of Microsoft Excel XLS file parsing until a patch is available. For Microsoft 365 Apps for Enterprise, avoid using potentially malicious files from untrusted sources to minimize the risk of exploitation. For Microsoft Excel, as a temporary workaround, consider disabling the parsing of XLS files until a patch is available. For Microsoft Office Web Apps Server, restrict access to the server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Use After Free

Code Injection

Weakness Enumeration

CWE-416

CWE-94

Related Identifiers

BDU:2021-02647

CVE-2021-31177

ZDI-21-576

Affected Products

365 Apps For Enterprise

Office Excel

Office

Office Web Apps Server

References · 13

• https://osv.dev/vulnerability/CVE-2021-31177 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-21-576 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31177 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02647 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31177 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-31177 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31177 · Security Note
• https://t.me/cvenotify/14587 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2021051110 · Note
• https://t.me/cvenotify/14402 · Telegram Post
• https://t.me/cvenotify/65534 · Telegram Post
• https://t.me/cvenotify/14406 · Telegram Post
• https://t.me/cvenotify/14405 · Telegram Post