KLA11213 Multiple vulnerabilities in Microsoft Office

Multiple serious vulnerabilities have been found in Microsoft Office. Malicious users can exploit these vulnerabilities to gain privileges, obtain sensitive information, bypass security restrictions or execute arbitrary code.

Below is a complete list of vulnerabilities:

1. An improper handling of objects in memory in Microsoft Access can be exploited locally via a specially designed document to execute arbitrary code;
2. An incorrect checking of macro settings in Microsoft Office Excel can be exploited locally via a specially designed document to bypass security restrictions;
3. An improper handling of requests in Microsoft SharePoint can be exploited remotely via a specially designed request to gain privileges;
4. Out-of-bound vulnerability in Microsoft Office can be exploited locally via a specially designed document to obtain sensitive information;
5. Memory corruption vulnerability in Microsoft Office can be exploited locally via a specially crafted document or remotely via a specially designed website to execute arbitrary code;
6. An improper tenant permissions verification in Microsoft SharePoint Server can be exploited remotely via a specially designed request to gain privileges.

Original advisories

CVE-2018-0903

CVE-2018-0907

CVE-2018-0909

CVE-2018-0910

CVE-2018-0911

CVE-2018-0912

CVE-2018-0913

CVE-2018-0914

CVE-2018-0915

CVE-2018-0916

CVE-2018-0917

CVE-2018-0919

CVE-2018-0921

CVE-2018-0922

CVE-2018-0923

CVE-2018-0944

CVE-2018-0947

Exploitation

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

Microsoft-Access

Microsoft-Office-Access

Microsoft-Office

Microsoft-Excel

CVE list

CVE-2018-0903 high

CVE-2018-0907 high

CVE-2018-0909 high

CVE-2018-0910 high

CVE-2018-0911 high

CVE-2018-0912 high

CVE-2018-0913 high

CVE-2018-0914 high

CVE-2018-0915 high

CVE-2018-0916 high

CVE-2018-0917 high

CVE-2018-0919 warning

CVE-2018-0921 high

CVE-2018-0922 critical

CVE-2018-0923 high

CVE-2018-0944 high

CVE-2018-0947 high

KB list

3114416

4011023

4011234

4011665

4011673

4011674

4011675

4011688

4011692

4011695

4011705

4011709

4011714

4011720

4011721

4011727

4011730

4018291

4018293

4018298

4018304

4018305

4018309

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

Affected Products

• Microsoft Access 2010 Service Pack 2 (32-bit editions)Microsoft Access 2010 Service Pack 2 (64-bit editions)Microsoft Access 2013 Service Pack 1 (32-bit editions)Microsoft Access 2013 Service Pack 1 (64-bit editions)Microsoft Access 2016 (32-bit edition)Microsoft Access 2016 (64-bit edition)Microsoft Excel 2007 Service Pack 3Microsoft Excel 2010 Service Pack 2 (32-bit editions)Microsoft Excel 2010 Service Pack 2 (64-bit editions)Microsoft Excel 2013 RT Service Pack 1Microsoft Excel 2013 Service Pack 1 (32-bit editions)Microsoft Excel 2013 Service Pack 1 (64-bit editions)Microsoft Excel 2016 (32-bit edition)Microsoft Excel 2016 (64-bit edition)Microsoft Office 2010 Service Pack 2 (32-bit editions)Microsoft Office 2010 Service Pack 2 (64-bit editions)Microsoft Office 2016Click-to-Run (C2R) for 32-bit editionsMicrosoft Office 2016 Click-to-Run (C2R) for 64-bit editionsMicrosoft Office 2016 for MacMicrosoft Office Compatibility Pack Service Pack 3Microsoft Office Online Server 2016Microsoft Office Web Apps 2010 Service Pack 2Microsoft Office Web Apps 2013 Service Pack 1Microsoft Office Web Apps Server 2013 Service Pack 1Microsoft Office Word ViewerMicrosoft Project Server 2013 Service Pack 1Microsoft SharePoint Enterprise Server 2013 Service Pack 1Microsoft SharePoint Enterprise Server 2016Microsoft SharePoint Foundation 2013 Service Pack 1Microsoft SharePoint Server 2010 Service Pack 2Microsoft Word 2007 Service Pack 3Microsoft Word 2010 Service Pack 2 (32-bit editions)Microsoft Word 2010 Service Pack 2 (64-bit editions)Microsoft Word 2013 (32-bit editions)Microsoft Word 2013 (64-bit editions)Microsoft Word 2013 RT Service Pack 1Microsoft Word 2013 Service Pack 1 (32-bit editions)Microsoft Word 2013 Service Pack 1 (64-bit editions)Microsoft Word 2016 (32-bit edition)Microsoft Word 2016 (64-bit edition)