Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
kasperskyKaspersky LabKLA11010
HistoryMay 09, 2017 - 12:00 a.m.

KLA11010 Remote code execution and elevation of privilege vulnerabilities in Microsoft Office

2017-05-0900:00:00
Kaspersky Lab
threats.kaspersky.com
117

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.955 High

EPSS

Percentile

99.4%

JSON

Detect date:

05/09/2017

Severity:

Critical

Description:

Multiple serious vulnerabilities have been found in Microsoft Office. Malicious users can exploit these vulnerabilities to execute arbitrary code and gain privileges.

Affected products:

Microsoft Office 2007 Service Pack 3
Microsoft Office 2010 Service Pack 2
Microsoft Office 2013 Service Pack 1
Microsoft Office 2013 RT Service Pack 1
Microsoft Office 2016
Microsoft Office 2016 for Mac
Microsoft Office Enterprise Server 2016
Microsoft Word 2007 Service Pack 3
Microsoft Word 2010 Service Pack 2
Microsoft Word 2013 RT Service Pack 1
Microsoft Word 2013 Service Pack 1
Microsoft PowerPoint for Mac 2011
Microsoft Office Compatibility Pack Service Pack 3
Microsoft Office Word Viewer
Skype for Business 2016

Solution:

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Original advisories:

CVE-2017-0261
CVE-2017-0262
CVE-2017-0265
CVE-2017-0264
CVE-2017-0281
CVE-2017-0254
CVE-2017-0255
CVE-2017-0281
CVE-2017-0265
CVE-2017-0264
CVE-2017-0262
CVE-2017-0261
CVE-2017-0255
CVE-2017-0254

Impacts:

ACE

Related products:

Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats

CVE-IDS:

CVE-2017-02819.3Critical
CVE-2017-02659.3Critical
CVE-2017-02649.3Critical
CVE-2017-02629.3Critical
CVE-2017-02619.3Critical
CVE-2017-02553.5Warning
CVE-2017-02549.3Critical

Microsoft official advisories:

KB list:

3191841
3191835
3191904
3191888
3191909
3191880
3191836
3191843
3178729
3191865
3162040
3191839
3118310
3172458
3114375
3191895
2596904
3191899
3191885
3191863
3191881
3191890
3191913
3191858
3191914
3191915
3212221

Exploitation:

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

References

Related

nessus 2
cve 7
prion 7
openvas 25
attackerkb 3
mskb 38
threatpost 2
securelist 4
rapid7community 1
mscve 7
symantec 7
cisa_kev 2
checkpoint_advisories 3
myhack58 2
thn 2
hackerone 1
fireeye 2
seebug 1
trendmicroblog 1
qualysblog 2
cisa 1
nessus
nessus
Security Update for Microsoft Office Products (May 2017)
2017-05-10 00:00:00
Security Update for Microsoft Office (May 2017) (macOS)
2017-05-19 00:00:00
cve
cve
CVE-2017-0261
2017-05-12 14:29:00
CVE-2017-0265
2017-05-12 14:29:00
CVE-2017-0281
2017-05-12 14:29:00
prion
prion
Remote code execution
2017-05-12 14:29:00
Remote code execution
2017-05-12 14:29:00
Remote code execution
2017-05-12 14:29:00
openvas
openvas
Microsoft Office Multiple Memory Corruption Vulnerabilities-KB3212221 (Mac OS X)
2017-05-19 00:00:00
Microsoft Office Word Remote Code Execution Vulnerabilities (KB3191865)
2017-05-10 00:00:00
Microsoft Office Suite Remote Code Execution Vulnerabilities (KB3172458)
2017-05-10 00:00:00
attackerkb
attackerkb
CVE-2017-0261
2017-05-12 00:00:00
CVE-2017-0262
2017-05-12 00:00:00
CVE-2017-0281
2017-05-12 00:00:00
mskb
mskb
Security update 2017-05-09
2017-05-09 07:00:00
Description of the security update for Word Automation Services on SharePoint Server 2013: May 9, 2017
2017-05-09 07:00:00
Description of the security update for Word 2016: May 9, 2017
2017-05-09 07:00:00
threatpost
threatpost
Microsoft Plugs Three Zero Day Holes as Part of May Patch Tuesday
2017-05-09 17:16:48
Updates to Sofacy, Turla Highlight 2017 Q2 APT Activity
2017-08-08 16:34:08
securelist
securelist
IT threat evolution Q2 2017. Statistics
2017-08-15 09:00:29
APT Trends report Q2 2017
2017-08-08 14:00:40
A Slice of 2017 Sofacy Activity
2018-02-20 14:00:06
rapid7community
rapid7community
Patch Tuesday - May 2017
2017-05-10 13:56:34
mscve
mscve
Microsoft Office Remote Code Execution Vulnerability
2017-05-09 07:00:00
Microsoft Office Memory Corruption Vulnerability
2017-05-09 07:00:00
Microsoft Office Remote Code Execution Vulnerability
2017-05-09 07:00:00
symantec
symantec
Microsoft Office CVE-2017-0265 Memory Corruption Vulnerability
2017-05-09 00:00:00
Microsoft Office CVE-2017-0262 Remote Code Execution Vulnerability
2017-05-09 00:00:00
Microsoft Office CVE-2017-0264 Memory Corruption Vulnerability
2017-05-09 00:00:00
cisa_kev
cisa_kev
Microsoft Office Remote Code Execution Vulnerability
2022-02-10 00:00:00
Microsoft Office Use-After-Free Vulnerability
2022-03-03 00:00:00
checkpoint_advisories
checkpoint_advisories
Microsoft Office EPS Remote Code Execution (CVE-2017-0262)
2017-05-10 00:00:00
Microsoft Office Remote Code Execution (CVE-2017-0261)
2020-09-22 00:00:00
Microsoft Office Multiple Remote Code Execution (CVE-2017-0261)
2017-05-10 00:00:00
myhack58
myhack58
For the APT organization to use the EPS vulnerabilities in and mention the right vulnerability analysis-vulnerability warning-the black bar safety net
2017-05-17 00:00:00
The macro perspective of the office vulnerability, 2010-2018-a vulnerability warning-the black bar safety net
2019-06-13 00:00:00
thn
thn
BADNEWS! Patchwork APT Hackers Score Own Goal in Recent Malware Attacks
2022-01-10 06:05:00
Microsoft Issues Patches for Another Four Zero-Day Vulnerabilities
2017-05-09 23:37:00
hackerone
hackerone
U.S. Dept Of Defense: Reflective Cross Site Scripting (XSS) on ███████/Pages
2022-12-06 10:42:15
fireeye
fireeye
EPS Processing Zero-Days Exploited by Multiple Threat Actors
2017-05-09 13:00:00
EPS Processing Zero-Days Exploited by Multiple Threat Actors
2017-05-09 13:00:00
seebug
seebug
Win32k Elevation of Privilege Vulnerability(CVE-2017-0263)
2017-05-19 00:00:00
trendmicroblog
trendmicroblog
TippingPoint Threat Intelligence and Zero-Day Coverage – Week of May 8, 2017
2017-05-12 16:47:57
qualysblog
qualysblog
Microsoft Fixes Malware Protection Engine and Several 0-Day Vulnerabilities, and Deprecates SHA-1
2017-05-09 18:06:52
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR
2022-02-23 05:39:00
cisa
cisa
CISA Adds 15 Known Exploited Vulnerabilities to Catalog
2022-02-10 00:00:00

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.955 High

EPSS

Percentile

99.4%

JSON
Related for KLA11010
nessus2cve7prion7openvas25attackerkb3mskb38threatpost2securelist4rapid7community1mscve7symantec7cisa_kev2checkpoint_advisories3myhack582thn2hackerone1fireeye2seebug1trendmicroblog1qualysblog2cisa1