Microsoft Access CVE-2019-1463 Information Disclosure Vulnerability

Description

Microsoft Access is prone to an information-disclosure vulnerability. An attacker can leverage this issue to obtain sensitive information that may aid in further attacks.

Technologies Affected

• Microsoft Office 2010 (32-bit edition) SP2
• Microsoft Office 2010 (64-bit edition) SP2
• Microsoft Office 2013 RT Service Pack 1
• Microsoft Office 2013 Service Pack 1 (32-bit editions)
• Microsoft Office 2013 Service Pack 1 (64-bit editions)
• Microsoft Office 2016 (32-bit edition)
• Microsoft Office 2016 (64-bit edition)
• Microsoft Office 2019 for 32-bit editions
• Microsoft Office 2019 for 64-bit editions
• Microsoft Office 365 ProPlus for 32-bit Systems
• Microsoft Office 365 ProPlus for 64-bit Systems

Recommendations

Permit local access for trusted individuals only. Where possible, use restricted environments and restricted shells.
To exploit this vulnerability, an attacker requires local interactive access to an affected computer. Grant local access for trusted and accountable users only.

Run all software as a nonprivileged user with minimal access rights.
To mitigate the impact of a successful exploit, run the affected application as a user with minimal access rights.

Do not accept or execute files from untrusted or unknown sources.
Never accept files from untrusted or unknown sources, because they may be malicious in nature. Avoid opening email attachments from unknown or questionable sources.

Updates are available. Please see the references or vendor advisory for more information.