9.3 - VU#882841

Executive Summary

Summary
Title	Microsoft Office file format converter memory corruption vulnerability

Informations
Name	VU#882841	First vendor Publication	2014-04-10
Vendor	VU-CERT	Last vendor Modification	2014-04-10
Severity (Vendor)	N/A	Revision	M

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score	9.3	Attack Range	Network
Cvss Impact Score	10	Attack Complexity	Medium
Cvss Expoit Score	8.6	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Vulnerability Note VU#882841

Microsoft Office file format converter memory corruption vulnerability

Original Release date: 10 Apr 2014 | Last revised: 10 Apr 2014

Overview

The Microsoft Office file format converter contains a memory corruption vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code with the privileges of the user.

Description

Microsoft Office file format converter is a component that converts legacy Microsoft Office documents into newer file formats. Microsoft Office Isolated Conversion Environment (MOICE), which is intended to increase the security of Microsoft Office, uses this capability. The Microsoft Office file format converter contains a memory corruption vulnerability.

Impact

By convincing a user to open a specially-crafted Office document, a remote, unauthenticated attacker may be able to execute arbitrary code with the privileges of the user.

Solution

Apply an update

This issue is addressed in Microsoft Security Bulletin MS14-017. Please also consider the following workarounds:

Use the Microsoft Enhanced Mitigation Experience Toolkit

The Microsoft Enhanced Mitigation Experience Toolkit (EMET) can be used to help prevent exploitation of this vulnerability. CERT/CC has created a video tutorial for setting up EMET 3.0 on Windows 7. Note that platforms that do not support ASLR, such as Windows XP and Windows Server 2003, will not receive the same level of protection that modern Windows platforms will.

Vendor Information (Learn More)

Vendor	Status	Date Notified	Date Updated
Microsoft Corporation	Affected	11 Sep 2013	10 Apr 2014

If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group	Score	Vector
Base	10.0	AV:N/AC:L/Au:N/C:C/I:C/A:C
Temporal	7.8	E:POC/RL:OF/RC:C
Environmental	5.9	CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

References

http://technet.microsoft.com/en-us/security/bulletin/ms14-017
http://support.microsoft.com/kb/935865

Credit

This issue was reported by Will Dormann of the CERT/CC.

This document was written by Will Dormann.

Other Information

CVE IDs:CVE-2014-1757
Date Public:08 Apr 2014
Date First Published:10 Apr 2014
Date Last Updated:10 Apr 2014
Document Revision:6

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Original Source

Url : http://www.kb.cert.org/vuls/id/882841

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-119	Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:24318

Oval ID:	oval:org.mitre.oval:def:24318
Title:	Microsoft Office file format converter vulnerability (CVE-2014-1757) - MS14-017
Description:	Microsoft Word 2007 SP3 and 2010 SP1 and SP2, and Office Compatibility Pack SP3, allocates memory incorrectly for file conversions from a binary (aka .doc) format to a newer format, which allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office File Format Converter Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2014-1757	Version:	7
Platform(s):	Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows 8.1 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2012 Microsoft Windows Server 2012 R2 Microsoft Windows Vista Microsoft Windows XP	Product(s):	Microsoft Office Compatibility Pack Microsoft Word 2007 Microsoft Word 2010
Definition Synopsis:
word 2007/version Microsoft Word 2007 SP3 is installed AND Check if the version of winword.exe is less than 12.0.6695.5000 OR compatibility pack/version Microsoft Office Compatibility Pack SP3 is installed AND Check if the version of wordcnv.dll is less than 12.0.6695.5000 OR word 2010 sp1/sp2/version word 2010 sp1/sp2 Microsoft Word 2010 SP1 is installed AND Microsoft Word 2010 SP2 is installed AND Check if the version of winword.exe is less than 14.0.7121.5004

CPE : Common Platform Enumeration

Type	Description	Count
Application	Microsoft Office Compatibility Pack cpe:2.3:a:microsoft:office_compatibility_pack::sp3::::::*	1
Application	Microsoft Word cpe:2.3:a:microsoft:word:2010:sp2:::::: cpe:2.3:a:microsoft:word:2010:sp1:::::: cpe:2.3:a:microsoft:word:2007:sp3::::::	3

Information Assurance Vulnerability Management (IAVM)

Date	Description
2014-04-10	IAVM : 2014-A-0049 - Multiple Vulnerabilities in Microsoft Office Severity : Category II - VMSKEY : V0048675

Nessus® Vulnerability Scanner

Date	Description
2014-04-08	Name : The remote host is affected by multiple memory corruption vulnerabilities. File : smb_nt_ms14-017.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2014-04-11 13:22:05	Multiple Updates
2014-04-10 17:19:31	First insertion

Global Informations

Type	Count
CWE ID(s)	1
Oval ID(s)	1
CPE ID(s)	4
IAVM(s)	1
Nessus® Exploit(s)	1

	Related
9.3	MS14-017
9.3	CVE-2014-1757
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 2 more Alert(s)