Kaspersky Threats

Detect date

?

09/12/2017

Severity

?

Critical

Description

Multiple serious vulnerabilities have been found in Microsoft Office. Malicious users can exploit these vulnerabilities to execute arbitrary code, obtain sensitive information and gain privileges.

Below is a complete list of vulnerabilities:

Multiple vulnerabilities related to an improper handling of objects in memory in Microsoft Office can be exploited locally via a specially designed file to execute arbitrary code;
An incorrect handling of objects in memory in Microsoft Graphics Component can be exploited remotely via a specially designed website to execute arbitrary code;
An improper handling of embedded fonts in Win32k Graphics can be exploited remotely via a specially designed website to execute arbitrary code;
Multiple vulnerabilities related to an incorrect handling of web requests in Microsoft SharePoint can be exploited remotely by sending a specially designed request to an affected server to gain privileges;
An improper handing of objects in memory in Windows Graphics Device Interface (GDI) can be exploited locally by running a specially designed application on affected system to obtain sensitive information;
An improper disclosure of content in memory in Windows Uniscribe can be exploited to obtain sensitive information.

Technical details

NB: Not every vulnerability already has CVSS rating, so cumulative CVSS rating can be not representative.

Affected products

Microsoft Office 2007 Service Pack 3
Microsoft Office 2010 Service Pack 2
Microsoft Office 2013 RT Service Pack 1
Microsoft Office 2013 Service Pack 1
Microsoft Office 2016
Microsoft Office 2016 for Mac
Microsoft Office Compatibility Pack Service Pack 3
Microsoft Office Web Apps 2010 Service Pack 2
Microsoft Office Web Apps 2013 Service Pack 1
Microsoft Office Web Apps Server 2013 Service Pack 1
Microsoft Office Word Viewer
Microsoft Office for Mac 2011
Microsoft Excel 2007 Service Pack 3
Microsoft Excel 2010 Service Pack 2
Microsoft Excel 2013 RT Service Pack 1
Microsoft Excel 2013 Service Pack 1
Microsoft Excel 2016
Microsoft Excel 2016 for Mac
Microsoft Excel Viewer 2007 Service Pack 3
Microsoft Excel Web App 2013 Service Pack 1
Microsoft Excel for Mac 2011
Microsoft Live Meeting 2007 Add-in
Microsoft Live Meeting 2007 Console
Microsoft Lync 2010
Microsoft Lync 2010 Attendee
Microsoft Lync 2013 Service Pack 1
Microsoft Lync Basic 2013 Service Pack 1
Microsoft Outlook 2007 Service Pack 3
Microsoft Outlook 2010 Service Pack 2
Microsoft Outlook 2013
Microsoft Outlook 2013 RT Service Pack 1
Microsoft Outlook 2016
Microsoft PowerPoint 2007 Service Pack 3
Microsoft PowerPoint 2010 Service Pack 2
Microsoft PowerPoint 2013 RT Service Pack 1
Microsoft PowerPoint 2013 Service Pack 1
Microsoft PowerPoint 2016
Microsoft PowerPoint Viewer 2007
Microsoft Publisher 2007 Service Pack 3
Microsoft Publisher 2010 Service Pack 2
Microsoft SharePoint Enterprise Server 2016
Microsoft SharePoint Foundation 2013 Service Pack 1
Microsoft SharePoint Server 2013 Service Pack 1
Office Online Server
Skype for Business 2016
Skype for Business 2016 Basic

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Original advisories

ADV170015
CVE-2017-8567
CVE-2017-8632
CVE-2017-8630
CVE-2017-8631
CVE-2017-8682
CVE-2017-8744
CVE-2017-8745
CVE-2017-8742
CVE-2017-8695
CVE-2017-8696
CVE-2017-8629
CVE-2017-8725
CVE-2017-8676
CVE-2017-8743
CVE-2017-8676
CVE-2017-8682
CVE-2017-8695
CVE-2017-8696
CVE-2017-8745
CVE-2017-8744
CVE-2017-8743
CVE-2017-8742
CVE-2017-8725
CVE-2017-8632
CVE-2017-8631
CVE-2017-8630
CVE-2017-8629
CVE-2017-8567

Impacts

?

ACE

[?]

OSI

[?]

DoS

[?]

SB

[?]

PE

[?]

SUI

[?]

Detect date ?	09/12/2017
Severity ?	Critical
Description	Multiple serious vulnerabilities have been found in Microsoft Office. Malicious users can exploit these vulnerabilities to execute arbitrary code, obtain sensitive information and gain privileges. Below is a complete list of vulnerabilities: Multiple vulnerabilities related to an improper handling of objects in memory in Microsoft Office can be exploited locally via a specially designed file to execute arbitrary code; An incorrect handling of objects in memory in Microsoft Graphics Component can be exploited remotely via a specially designed website to execute arbitrary code; An improper handling of embedded fonts in Win32k Graphics can be exploited remotely via a specially designed website to execute arbitrary code; Multiple vulnerabilities related to an incorrect handling of web requests in Microsoft SharePoint can be exploited remotely by sending a specially designed request to an affected server to gain privileges; An improper handing of objects in memory in Windows Graphics Device Interface (GDI) can be exploited locally by running a specially designed application on affected system to obtain sensitive information; An improper disclosure of content in memory in Windows Uniscribe can be exploited to obtain sensitive information. Technical details NB: Not every vulnerability already has CVSS rating, so cumulative CVSS rating can be not representative.
Affected products	Microsoft Office 2007 Service Pack 3 Microsoft Office 2010 Service Pack 2 Microsoft Office 2013 RT Service Pack 1 Microsoft Office 2013 Service Pack 1 Microsoft Office 2016 Microsoft Office 2016 for Mac Microsoft Office Compatibility Pack Service Pack 3 Microsoft Office Web Apps 2010 Service Pack 2 Microsoft Office Web Apps 2013 Service Pack 1 Microsoft Office Web Apps Server 2013 Service Pack 1 Microsoft Office Word Viewer Microsoft Office for Mac 2011 Microsoft Excel 2007 Service Pack 3 Microsoft Excel 2010 Service Pack 2 Microsoft Excel 2013 RT Service Pack 1 Microsoft Excel 2013 Service Pack 1 Microsoft Excel 2016 Microsoft Excel 2016 for Mac Microsoft Excel Viewer 2007 Service Pack 3 Microsoft Excel Web App 2013 Service Pack 1 Microsoft Excel for Mac 2011 Microsoft Live Meeting 2007 Add-in Microsoft Live Meeting 2007 Console Microsoft Lync 2010 Microsoft Lync 2010 Attendee Microsoft Lync 2013 Service Pack 1 Microsoft Lync Basic 2013 Service Pack 1 Microsoft Outlook 2007 Service Pack 3 Microsoft Outlook 2010 Service Pack 2 Microsoft Outlook 2013 Microsoft Outlook 2013 RT Service Pack 1 Microsoft Outlook 2016 Microsoft PowerPoint 2007 Service Pack 3 Microsoft PowerPoint 2010 Service Pack 2 Microsoft PowerPoint 2013 RT Service Pack 1 Microsoft PowerPoint 2013 Service Pack 1 Microsoft PowerPoint 2016 Microsoft PowerPoint Viewer 2007 Microsoft Publisher 2007 Service Pack 3 Microsoft Publisher 2010 Service Pack 2 Microsoft SharePoint Enterprise Server 2016 Microsoft SharePoint Foundation 2013 Service Pack 1 Microsoft SharePoint Server 2013 Service Pack 1 Office Online Server Skype for Business 2016 Skype for Business 2016 Basic
Solution	Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)
Original advisories	ADV170015 CVE-2017-8567 CVE-2017-8632 CVE-2017-8630 CVE-2017-8631 CVE-2017-8682 CVE-2017-8744 CVE-2017-8745 CVE-2017-8742 CVE-2017-8695 CVE-2017-8696 CVE-2017-8629 CVE-2017-8725 CVE-2017-8676 CVE-2017-8743 CVE-2017-8676 CVE-2017-8682 CVE-2017-8695 CVE-2017-8696 CVE-2017-8745 CVE-2017-8744 CVE-2017-8743 CVE-2017-8742 CVE-2017-8725 CVE-2017-8632 CVE-2017-8631 CVE-2017-8630 CVE-2017-8629 CVE-2017-8567
Impacts ?	ACE [?] OSI [?] DoS [?] SB [?] PE [?] SUI [?]
Related products	Microsoft Office Live Meeting 2007 Microsoft Lync Microsoft Office PowerPoint Microsoft Office Microsoft Outlook Microsoft Excel Microsoft Word Microsoft Sharepoint Server
CVE-IDS ?	CVE-2017-86762.1Warning CVE-2017-86829.3Critical CVE-2017-86952.6Warning CVE-2017-86967.6Critical CVE-2017-87453.5Warning CVE-2017-87449.3Critical CVE-2017-87439.3Critical CVE-2017-87429.3Critical CVE-2017-87259.3Critical CVE-2017-86329.3Critical CVE-2017-86319.3Critical CVE-2017-86309.3Critical CVE-2017-86293.5Warning CVE-2017-85679.3Critical
Microsoft official advisories	Microsoft Security Update Guide
KB list	3213649 3213644 3213646 3213641 3213642 3213560 4025867 3213562 3213564 3191831 4011117 3128030 4025868 3213631 4025865 4025866 4011113 3213638 4011069 3141537 4011041 4011040 4011065 4011064 4011089 4011062 4011061 4011134 3213658 3213626 3203474 3213551 3212225 4011056 4011055 4011050 4011038 4011063 4011107 3128027 4025869 4011090 4011091 3114428 4011103 4011126 4011127 3213632 4011108 4011125 4011110
Exploitation	The following public exploits exists for this vulnerability: https://www.exploit-db.com/exploits/42744 Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.