Search...

New UAF Vulnerability Affecting Microsoft Office to be Patched Today

2021-06-08T10:31:00
ID THN:76EF51D1EBDAA5B92DD55E9E74F5B542
Type thn
Reporter The Hacker News
Modified 2021-06-09T04:21:48

Description

Four security vulnerabilities discovered in the Microsoft Office suite, including Excel and Office online, could be potentially abused by bad actors to deliver attack code via Word and Excel documents.

"Rooted from legacy code, the vulnerabilities could have granted an attacker the ability to execute code on targets via malicious Office documents, such as Word, Excel and Outlook," researchers from Check Point research said in a report published today.

Three of the four flaws — tracked as CVE-2021-31174, CVE-2021-31178, CVE-2021-31179 — have been fixed by Microsoft as part of its Patch Tuesday update for May 2021, with the fourth patch (CVE-2021-31939) to be issued in June's update rolling out later today.

Stack Overflow Teams

In a hypothetical attack scenario, the researchers said the vulnerability could be triggered as simply as opening a malicious Excel (.XLS) file that's served via a download link or an email.

Arising out of parsing mistakes made in legacy code found in Excel 95 file formats, the vulnerabilities were found by fuzzing MSGraph ("MSGraph.Chart.8"), a relatively under-analyzed component in Microsoft Office component that's at par to Microsoft Equation Editor in terms of the attack surface. Equation Editor, a now-defunct feature in Word, has become a part of the arsenal of several -related threat actors at least since late 2018.

"Since the entire Office suite has the ability to embed Excel objects, this broadens the attack vector, making it possible to execute such an attack on almost any Office software, including Word, Outlook and others," Check Point researchers said.

The list of four vulnerabilities are as follows -

  • CVE-2021-31179 - Microsoft Office Remote Code Execution Vulnerability
  • CVE-2021-31174 - Microsoft Excel Information Disclosure Vulnerability
  • CVE-2021-31178 - Microsoft Office Information DisclosureChinese Vulnerability
  • CVE-2021-31939 - Microsoft Excel Remote Code Execution Vulnerability

Microsoft, in its advisories for CVE-2021-31179 and CVE-2021-31939, noted that exploitation of the vulnerability requires that a user open a specially-crafted file, adding the adversary would have to trick victims into clicking a link that redirects users to the malicious document.

Prevent Data Breaches

"The vulnerabilities found affect almost the entire Microsoft Office ecosystem," said Yaniv Balmas, Head of Cyber Research at Check Point. "It's possible to execute such an attack on almost any Office software, including Word, Outlook and others. One of the primary learnings from our research is that legacy code continues to be a weak link in the security chain, especially in complex software like Microsoft Office."

Windows users are strongly recommended to apply the patches as soon as possible to mitigate the risk and avoid attacks that could exploit the aforementioned weaknesses.

Found this article interesting? Follow THN on Facebook, Twitter and LinkedIn to read more exclusive content we post.

JSON Vulners Source
Initial Source


All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please mail to content@vulners.com Vulners, 2018
Protected by