Vulnerability

CERT-In Vulnerability Note CIVN-2016-0314
Multiple Vulnerabilities in Microsoft Office

Original Issue Date:December 14, 2016

Severity Rating: HIGH

Software Affected

Microsoft Excel 2007 SP3
Microsoft Office 2010 SP2 (32-bit editions)
Microsoft Office 2010 SP2 (64-bit editions)
Microsoft Excel 2013 SP1 (32-bit editions)
Microsoft Excel 2013 SP1 (64-bit editions)
Microsoft Excel 2013 RT SP1
Microsoft Excel 2016 (32-bit edition)
Microsoft Excel 2016 (64-bit edition)
Microsoft Office Compatibility Pack SP3
Microsoft Excel Viewer
Microsoft Word Viewer
Microsoft Publisher 2010 SP2 (32-bit editions)
Microsoft Publisher 2010 SP2 (64-bit editions)
Microsoft Excel for Mac 2011
Microsoft Word for Mac 2011
Microsoft Excel 2016 for Mac
Microsoft Office 2016 for Mac
Microsoft Auto Updater for Mac
Excel Services on Microsoft SharePoint Server 2007 SP3 (32-bit edition)
Excel Services on Microsoft SharePoint Server 2007 SP3 (64-bit edition)
Excel Services on Microsoft SharePoint Server 2010 SP2
Word Automation Services on Microsoft SharePoint Server 2010 SP2
Microsoft Office Web Apps 2010 SP2

Overview

Multiple vulnerabilities have been reported in Microsoft Office which could be exploited by unauthenticated remote attacker to execute arbitrary code, cause memory corruption, access sensitive information, elevate privileges or bypass security restrictions.

Description

1. Information Disclosure Vulnerability ( CVE-2016-7264   CVE-2016-7265   CVE-2016-7268   CVE-2016-7276   CVE-2016-7290   CVE-2016-7291   )

These vulnerabilities exist due to improper initialization of affected variables within the affected software which could result in an out of bound memory error. A remote attacker could exploit the vulnerability by persuading the targeted user to open specially crafted Microsoft document. Successful exploitation of the vulnerability could allow the attacker to access view out of bound memory which could lead to further attacks.

2. Information Disclosure Vulnerability ( CVE-2016-7257   )

This vulnerability is due to improper handling of objects in memory by Microsoft Office. A remote attacker could exploit this vulnerability by hosting a website containing a specially crafted file or sending a specially crafted file via email and enticing the targeted user to open it. Successful exploitation could allow an attacker to access sensitive memory information to bypass the Address Space Layout Randomization (ASLR) feature, which could be leveraged to conduct further attacks.

3. Memory Corruption Vulnerabilities ( CVE-2016-7263   CVE-2016-7277   CVE-2016-7289   CVE-2016-7298   )

These vulnerabilities exist due to improper handling of memory objects in Microsoft Office. A remote attacker could exploit these vulnerabilities by convincing the user to open specially crafted Microsoft document. Successful exploitation of these vulnerabilities could allow the attacker to execute arbitrary code on the target system in the context of the currently logged in user or could result in a complete system compromise, if the user holds elevated privileges.

4. OLE DLL Side Loading Vulnerability ( CVE-2016-7275   )

This vulnerability exists due to improper validation of user-supplied input before loading libraries by Microsoft Office. An authenticated, attacker could exploit this vulnerability by executing a specially crafted application to gain elevated
privileges.

5. Security Feature Bypass Vulnerability ( CVE-2016-7267   )

This vulnerability exists due to improper parsing of file formats by Microsoft Office. An attacker could exploit this vulnerability by enticing a convincing a user to open a specially crafted file with an affected version. Successful exploitation of this vulnerability could allow an attacker to bypass security restrictions.

6. Security Feature Bypass Vulnerability ( CVE-2016-7262   )

This vulnerability exists due to improper validation of user-supplied input by Microsoft Office. An attacker could exploit this vulnerability by sending and convincing a user to open a specially crafted file. Successful exploitation of this vulnerability could allow the attacker to bypass security restrictions on the targeted system, and further could lead to arbitrary command execution.

7. Security Feature Bypass Vulnerability ( CVE-2016-7266   )

This vulnerability exists due to improper checks of registry settings by Microsoft Office when attempts are made to run embedded content. An attacker could exploit this vulnerability by convincing a user to open a specially crafted file.
Successful exploitation of this vulnerability could allow the attacker to bypass security restrictions on the targeted system, and also could be used to execute arbitrary commands on the targeted system.

8. Elevation of Privilege Vulnerability ( CVE-2016-7300   )

This vulnerability exists due to improper validation of updates before executing them by Microsoft AutoUpdate (MAU) application for Mac. An attacker who can execute arbitrary code on a targeted system could exploit this vulnerability by placing a specially crafted executable file in a specific location used by the MAU application. Successful exploitation of this vulnerability could allow the attacker to execute arbitrary code with elevated privileges, which could result in a complete system compromise.

Solution

Apply appropriate updates as mentioned in the Microsoft Security Bulletin MS16-148

Vendor Information

Microsoft
https://technet.microsoft.com/en-us/library/security/ms16-148.aspx

References

Microsoft
https://technet.microsoft.com/en-us/library/security/ms16-148.aspx

CVE Name
CVE-2016-7264
CVE-2016-7265
CVE-2016-7268
CVE-2016-7276
CVE-2016-7290
CVE-2016-7291
CVE-2016-7263
CVE-2016-7277
CVE-2016-7289
CVE-2016-7298
CVE-2016-7257
CVE-2016-7275
CVE-2016-7267
CVE-2016-7262
CVE-2016-7300

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India