Who is affected?
Organisations running Office versions since:
• Office 2007
• SharePoint Foundation 2010 SP2
• SharePoint Foundation 2013 SP1
• Microsoft SharePoint Server 2016.
What is the vulnerability?
Multiple remote code execution vulnerabilities exist in Microsoft Office software when the Office software fails to properly handle objects in memory.
• An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system.
• An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
• Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
Exploitation of the vulnerabilities requires that a user opens a specially crafted file with an affected version of Microsoft Office software.
• In an email attack scenario an attacker could exploit the vulnerabilities by sending the specially crafted file to the user and convincing the user to open the file.
• In a web-based attack scenario an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file that is designed to exploit the vulnerabilities.
An attacker would have no way to force users to visit the website. Instead, an attacker would have to convince users to click a link, typically by way of an enticement in an email or Instant Messenger message, and then convince them to open the specially crafted file.
What should I do?
We suggest you contact us on (03) 8587 7500 to book in a time to discuss how this issue affects your organisation and how we can assist you in its remediation.
Or navigate to https://support.microsoft.com/en-us/kb/3170008 and complete the updates.
Rethink IT Security
Symantec Vulnerabilities Uncovered