63 lines
No EOL
2.4 KiB
Text
63 lines
No EOL
2.4 KiB
Text
#####################################################################################
|
|
|
|
# Application: Microsoft Office Word
|
|
# Platforms: Windows, OSX
|
|
# Versions: Microsoft Office Word 2013,2016
|
|
# Author: Francis Provencher of COSIG
|
|
# Website: https://cosig.gouv.qc.ca/en/advisory/
|
|
# Twitter: @COSIG_
|
|
# Date: August 09, 2016
|
|
# CVE: CVE-2016-3316
|
|
# COSIG-2016-32
|
|
|
|
#####################################################################################
|
|
|
|
1) Introduction
|
|
2) Report Timeline
|
|
3) Technical details
|
|
4) POC
|
|
|
|
#######################################################################################
|
|
|
|
===================
|
|
1) Introduction
|
|
===================
|
|
|
|
Microsoft Word is a word processor developed by Microsoft. It was first released on October 25, 1983[3]
|
|
under the name Multi-Tool Word for Xenix systems.[4][5][6] Subsequent versions were later written for several
|
|
other platforms including IBM PCs running DOS (1983), Apple Macintosh running Mac OS (1985), AT&T Unix PC (1985),
|
|
Atari ST (1988), OS/2 (1989), Microsoft Windows (1989) and SCO Unix (1994). Commercial versions of Word are licensed
|
|
as a standalone product or as a component of Microsoft Office, Windows RT or the discontinued Microsoft Works suite.
|
|
Microsoft Word Viewer and Office Online are Freeware editions of Word with limited features.
|
|
|
|
(https://en.wikipedia.org/wiki/Microsoft_Word)
|
|
|
|
#######################################################################################
|
|
|
|
===================
|
|
2) Report Timeline
|
|
===================
|
|
|
|
2016-05-15: Francis Provencher of COSIG report the vulnerability to MSRC.
|
|
2016-06-07: MSRC confirm the vulnerability
|
|
2016-08-09: Microsoft fixed the issue (MS16-099).
|
|
2016-08-09: Advisory released.
|
|
|
|
#######################################################################################
|
|
|
|
===================
|
|
3) Technical details
|
|
===================
|
|
|
|
The specific flaw exists within the parsing of invalid operand in “sprmSdyaTop” into a SEPX structure.
|
|
An attacker can use this flaw to read outside the allocated buffer, which could allow for the execution of arbitrary code in the context of the current process.
|
|
#######################################################################################
|
|
|
|
==========
|
|
4) POC
|
|
==========
|
|
|
|
https://cosig.gouv.qc.ca/wp-content/uploads/2016/08/COSIG-2016-32.doc
|
|
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40238.zip
|
|
|
|
####################################################################################### |