Kaspersky LabKLA11301KLA11301 Multiple vulnerabilities in Microsoft Office
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
7.2 High
AI Score
Confidence
High
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.226 Low
EPSS
Percentile
96.4%
Detect date:
08/14/2018
Severity:
High
Description:
Multiple serious vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges, obtain sensitive information.
Affected products:
Microsoft Excel 2016 Click-to-Run (C2R) for 32-bit editions
Microsoft Excel 2016 Click-to-Run (C2R) for 64-bit editions
Microsoft Excel 2010 Service Pack 2 (32-bit editions)
Microsoft Excel 2010 Service Pack 2 (64-bit editions)
Microsoft Excel 2013 RT Service Pack 1
Microsoft Excel 2013 Service Pack 1 (32-bit editions)
Microsoft Excel 2013 Service Pack 1 (64-bit editions)
Microsoft Excel 2016 (32-bit edition)
Microsoft Excel 2016 (64-bit edition)
Microsoft Excel Viewer 2007 Service Pack 3
Microsoft Office 2016 for Mac
Microsoft Office Compatibility Pack Service Pack 3
Solution:
Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)
Original advisories:
CVE-2018-8379
CVE-2018-8375
CVE-2018-8412
CVE-2018-8378
CVE-2018-8376
CVE-2018-8382
ADV180021
CVE-2018-8379
CVE-2018-8375
CVE-2018-8412
CVE-2018-8378
CVE-2018-8376
Impacts:
ACE
Related products:
CVE-IDS:
CVE-2018-83799.3Critical
CVE-2018-83759.3Critical
CVE-2018-84124.6Warning
CVE-2018-83784.3Warning
CVE-2018-83769.3Critical
CVE-2018-83824.3Warning
KB list:
4018310
4018392
4032213
4032222
4032240
3213636
4022238
4022236
4032220
4032212
4032233
4032239
4022234
4032256
4022195
4032229
4032223
4092434
4022198
4032241
4032215
4092433
4032235
Microsoft official advisories:
Exploitation:
Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.
References
support.microsoft.com/kb/3213636
support.microsoft.com/kb/4018310
support.microsoft.com/kb/4018392
support.microsoft.com/kb/4022195
support.microsoft.com/kb/4022198
support.microsoft.com/kb/4022234
support.microsoft.com/kb/4022236
support.microsoft.com/kb/4022238
support.microsoft.com/kb/4032212
support.microsoft.com/kb/4032213
support.microsoft.com/kb/4032215
support.microsoft.com/kb/4032220
support.microsoft.com/kb/4032222
support.microsoft.com/kb/4032223
support.microsoft.com/kb/4032229
support.microsoft.com/kb/4032233
support.microsoft.com/kb/4032235
support.microsoft.com/kb/4032239
support.microsoft.com/kb/4032240
support.microsoft.com/kb/4032241
support.microsoft.com/kb/4032256
support.microsoft.com/kb/4092433
support.microsoft.com/kb/4092434
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8375
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8376
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8378
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8379
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8382
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8412
portal.msrc.microsoft.com/en-us/security-guidance
portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180021
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8375
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8375
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8376
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8376
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8378
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8378
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8379
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8379
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8382
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8412
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8412
statistics.securelist.com/vulnerability-scan/month
threats.kaspersky.com/en/class/Exploit/
threats.kaspersky.com/en/product/Microsoft-Office/
Related
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
7.2 High
AI Score
Confidence
High
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.226 Low
EPSS
Percentile
96.4%