CERT-In Vulnerability Note
CIVN-2017-0176
Multiple Vulnerabilities in Microsoft Office
Original Issue Date:November 22, 2017
Severity Rating: HIGH
Software Affected
- Microsoft Excel 2007 SP 3
- Microsoft Excel 2010 SP 2 32-bit and 64-bit editions
- Microsoft Excel 2013 RT SP 1
- Microsoft Excel 2013 SP 1 32-bit and 64-bit editions
- Microsoft Excel 2016 32-bit and 64-bit editions
- Microsoft Excel 2016 Click-to-Run (C2R) for 32-bit and 64-bit editions
- Microsoft Excel 2016 for Mac
- Microsoft Excel Viewer 2007 SP 3
- Microsoft Office 2007 SP 3
- Microsoft Office 2010 SP 2 for 32-bit and 64-bit editions
- Microsoft Office 2013 SP 1 for 32-bit and 64-bit editions
- Microsoft Office 2016 for 32-bit and 64-bit editions
- Microsoft Office Compatibility Pack SP 3
- Microsoft Project Server 2013 SP 1
- Microsoft SharePoint Enterprise Server 2016
- Microsoft Word 2007 SP 3
- Microsoft Word 2010 SP 2 for 32-bit and 64-bit editions
Overview
Multiple vulnerabilities have been reported in Microsoft Office that could allow a remote attacker to execute arbitrary code and gain elevated privileges on the target system.
Description
1. Microsoft Office Privilege Escalation Vulnerability
(
CVE-2017-11876
)
The vulnerability exists due to the improper handling of user sessions by the Microsoft Project Server. A remote attacker could exploit this vulnerability by hosting a specially crafted file on website and enticing a user to follow a malicious link to open that crafted file to conduct a cross-site request forgery (CSRF) attack. Successful exploitation of this vulnerability could allow the attacker to gain elevated privileged of the logged in user and perform action privileges on the target system.
2. Microsoft Office Security Bypass Vulnerability
(
CVE-2017-11877
)
The vulnerability exists in Microsoft Office due to the improper implementation of macro settings by the affected software. A remote attacker could exploit this vulnerability by enticing the user to open a specially crafted file with an affected version. Successful exploitation of this vulnerability could allow the attacker to bypass security features on the target system.
3. Microsoft Office Memory Corruption Vulnerabilities
(
CVE-2017-11878
CVE-2017-11882
CVE-2017-11884
CVE-2017-11854
)
These vulnerabilities exist in Microsoft Office software due to the improper handling of objects in memory. A remote attacker could exploit this vulnerability by hosting a specially crafted file on website and persuading a user to follow a malicious link to view the crafted file. Successful exploitation of this vulnerability could allow the attacker to execute arbitrary code in security context of the logged in user.
Solution
Apply appropriate software fixes as available on the vendor website.
https://portal.msrc.microsoft.com/en-us/security-guidance
https://portal.msrc.microsoft.com/en-us/security-guidance/releasenotedetail/bae9d0d8-e497-e711-80e5-000d3a32fc99
Vendor Information
Microsoft
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11876
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11877
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11878
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11882
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11884
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11854
References
Cisco
https://tools.cisco.com/security/center/viewAlert.x?alertId=55867
https://tools.cisco.com/security/center/viewAlert.x?alertId=55868
https://tools.cisco.com/security/center/viewAlert.x?alertId=55869
https://tools.cisco.com/security/center/viewAlert.x?alertId=55872
https://tools.cisco.com/security/center/viewAlert.x?alertId=55876
https://tools.cisco.com/security/center/viewAlert.x?alertId=55851
CVE Name
CVE-2017-11876
CVE-2017-11877
CVE-2017-11878
CVE-2017-11882
CVE-2017-11884
CVE-2017-11854
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|