Remote code execution in Microsoft Excel

Published: 2019-10-09

Risk	High
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2019-1327 CVE-2019-1331
CWE-ID	CWE-20
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	Microsoft Excel Client/Desktop applications / Office applications Microsoft Office for Mac Client/Desktop applications / Office applications Microsoft Office Client/Desktop applications / Office applications Excel Services on Microsoft SharePoint Server Client/Desktop applications / Office applications Office Online Server Server applications / Other server solutions Microsoft SharePoint Server Server applications / Application servers
Vendor	Microsoft

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Input validation error

EUVDB-ID: #VU21649

Risk: High

CVSSv3.1:

CVE-ID: CVE-2019-1327

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insufficient validation of user-supplied input when the software fails to properly handle objects in memory in Microsoft Excel software.

Successful exploitation of the vulnerability allows remote code execution but requires that a user open a specially crafted file with an affected version of Microsoft Excel.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Microsoft Excel: 2010 - 2016

Microsoft Office for Mac: 2016

Microsoft Office: 365 ProPlus - 2019 for Mac

Fixed software versions

CPE2.3

cpe:2.3:a:microsoft:microsoft_excel:2010:*:*:*:*:microsoft_office:*:*

External links

http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1327

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

2) Input validation error

EUVDB-ID: #VU21650