‫ Microsoft Office Multiple Vulnerabilities

ID: IRCAD2015104115

Release Date: 2015-10-13

Software:

Microsoft Excel 2010

Microsoft Excel 2011 for Mac

Microsoft Excel 2013

Microsoft Excel 2013 RT

Microsoft Excel 2016

Microsoft Excel 2016 for Mac

Microsoft Office 2007

Microsoft Office 2010

Microsoft Office 2013

Microsoft Office 2013 RT

Microsoft Office 2016

Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats

Microsoft Office Excel 2007

Microsoft Office Excel Viewer 2007

Microsoft Office for Mac 2011

Microsoft Office for Mac 2016

Microsoft Office SharePoint Server 2007

Microsoft Office Web Apps 2010

Microsoft Office Web Apps 2013

Microsoft SharePoint Server 2007

Microsoft SharePoint Server 2010

Microsoft SharePoint Server 2013

Microsoft Visio 2007

Microsoft Visio 2010

Description:

Multiple vulnerabilities have been reported in Microsoft Office, which can be exploited by malicious users to disclose sensitive information and bypass certain security restrictions and by malicious people to conduct cross-site scripting attacks and compromise a user's system.

1) A use-after-free error when processing calculatedColumnFormula objects can be exploited to corrupt memory.

2) An error when parsing UML can be exploited to corrupt memory via a specially crafted Visio file.

3) A use-after-free error the fileVersion element in the workbook can be exploited to corrupt memory.

Successful exploitation of the vulnerabilities #1 through #3 may allow execution of arbitrary code.

4) Certain input related to the Office Web Apps Server is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

5) An error within the SharePoint InfoPath Forms Services when parsing the Document Type Definition of an XML file can be exploited to disclose the content of arbitrary files.

Successful exploitation of this vulnerability requires write permissions to the site and that "InfoPath Services" is enabled.

Solution

Apply update.

References:

Microsoft (KB3096440, KB3085615, KB3085542, KB3085609, KB3085514, KB3085583, KB2920693, KB3097266, KB3097264, KB3085619, KB3085618, KB3054994, KB3085596, KB3085568, KB3085520, KB3085595, KB3085571, KB2596670, KB2553405, KB3085567, and KB3085582):

https://technet.microsoft.com/en-us/library/security/ms15-110.aspx

ZDI:

http://www.zerodayinitiative.com/advisories/ZDI-15-516/

http://www.zerodayinitiative.com/advisories/ZDI-15-517/

http://www.zerodayinitiative.com/advisories/ZDI-15-519/

Secunia:

https://secunia.com/advisories/66848/

 


نظرات

بدون نظر
شما برای نظر دادن باید وارد شوید

نوشته

 
تاریخ ایجاد: 27 مهر 1394

امتیاز

امتیاز شما
تعداد امتیازها:0