CERT-In Vulnerability Note
CIVN-2015-0303
Multiple Vulnerabilities in Microsoft Office
Original Issue Date:December 09, 2015
Severity Rating: HIGH
Systems Affected
- Microsoft Office 2007 Service Pack 3
- Microsoft Excel 2007 Service Pack 3
- Microsoft Word 2007 Service Pack 3
- Microsoft Office 2010 Service Pack 2 (32-bit editions)
- Microsoft Office 2010 Service Pack 2 (64-bit editions)
- Microsoft Excel 2010 Service Pack 2 (32-bit editions)
- Microsoft Excel 2010 Service Pack 2 (64-bit editions)
- Microsoft Word 2010 Service Pack 2 (32-bit editions)
- Microsoft Word 2010 Service Pack 2 (64-bit editions)
- Microsoft Word 2013 Service Pack 1 (32-bit editions)
- Microsoft Word 2013 Service Pack 1 (64-bit editions)
- Microsoft Word 2016 (32-bit edition)
- Microsoft Word 2016 (64-bit edition)
- Microsoft Word 2013 RT Service Pack 1
- Microsoft Excel for Mac 2011
- Microsoft Office 2016 for Mac
- Microsoft Office Compatibility Pack Service Pack 3
- Microsoft Excel Viewer
Overview
Multiple remote code execution vulnerabilities have been reported in Microsoft Office which could be exploited by a remote attacker to execute arbitrary code on the affected system in the context of currently logged-in user.
Description
1. Multiple Memory Corruption Vulnerabilities in Microsoft Office
(
CVE-2015-6040
CVE-2015-6118
CVE-2015-6122
CVE-2015-6124
CVE-2015-6177
)
Multiple memory corruption vulnerabilities exist in Microsoft Office due to improper handling of the memory objects. A remote attacker could exploit these vulnerabilities by convincing a user to open a specially crafted document. Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code on the targeted system with the privileges of the logged-in user.
2. Remote Code Execution Vulnerability
(
CVE-2015-6172
)
The vulnerability exists due to improper parsing of specially crafted email messages by Microsoft Office Outlook. A remote attacker could exploit these vulnerabilities by convincing a user to preview or open a specially crafted email message on Outlook. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the targeted system with the privileges of the logged-in user.
Workaround
- Disable previewing messages in Outlook
- Disable reading Outlook email messages in HTML
Solution
Apply appropriate updates as mentioned in the Microsoft Security Bulletin
MS15-131
Vendor Information
Microsoft
https://technet.microsoft.com/en-us/library/security/ms15-131
References
Microsoft
https://technet.microsoft.com/en-us/library/security/ms15-131
Cisco
http://tools.cisco.com/security/center/viewAlert.x?alertId=42400
http://tools.cisco.com/security/center/viewAlert.x?alertId=42401
http://tools.cisco.com/security/center/viewAlert.x?alertId=42402
http://tools.cisco.com/security/center/viewAlert.x?alertId=42403
http://tools.cisco.com/security/center/viewAlert.x?alertId=42404
http://tools.cisco.com/security/center/viewAlert.x?alertId=42405
SecurityFocus
http://www.securityfocus.com/bid/78543
http://www.securityfocus.com/bid/78546
http://www.securityfocus.com/bid/78547
http://www.securityfocus.com/bid/78548
http://www.securityfocus.com/bid/78549
http://www.securityfocus.com/bid/78550
CVE Name
CVE-2015-6040
CVE-2015-6118
CVE-2015-6122
CVE-2015-6124
CVE-2015-6172
CVE-2015-6177
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in
Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|