Microsoft Word RTF File Processing Vulnerability
Last Update Date:
25 Mar 2014 09:19
Release Date:
25 Mar 2014
3329
Views
RISK: Extremely High Risk
TYPE: Clients - Productivity Products
A vulnerability has been identified in Microsoft Word. A remote user can cause arbitrary code to be executed on the target user's system.
A remote user can create a specially crafted RTF file that, when loaded by the target user, will trigger a memory corruption error and execute arbitrary code on the target system. The code will run with the privileges of the target user.
Note:
- Microsoft is aware of limited, targeted attacks directed at Microsoft Word 2010.
- Vendor patch is currently unavailable.
Impact
- Remote Code Execution
System / Technologies affected
- Microsoft Word 2003 SP3
- Microsoft Word 2007 SP3
- Microsoft Word 2010 SP1
- Microsoft Word 2010 SP2
- Microsoft Word 2013
- Microsoft Word 2013 RT
- Microsoft Office Compatibility Pack SP3 and Word Viewer
- Microsoft Office for Mac 2011
- Word Automation Services on Microsoft SharePoint Server 2010 SP1
- Word Automation Services on Microsoft SharePoint Server 2010 SP2
- Word Automation Services on Microsoft SharePoint Server 2013
- Microsoft Office Web Apps 2010 SP1
- Microsoft Office Web Apps 2010 SP2
- Microsoft Office Web Apps Server 2013
Solutions
Note: Vendor patch is currently unavailable.
Wordaround:
- Apply Microsoft Fix it solution "Disable opening RTF content in Microsoft Word".
http://technet.microsoft.com/en-us/security/advisory/2953095
Vulnerability Identifier
Source
Related Link
Share with