Microsoft Office Excel 2002 SP3, 2007 SP1, and SP2; Office 2004 for mac; Office 2008 for Mac; Open XML File Format Converter for Mac; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2; allows remote attackers to execute arbitrary code via an Excel file with crafted DBQueryExt records that allow a function call to a "user-controlled pointer," aka "Excel ADO Object Vulnerability."

Threat-Mapped Scoring

Score: 1.8

Priority: P4 - Informational (Low)

• S9 – Sabotage of System/App

EPSS

Score: 0.60976
Percentile: 0.98201

CVSS Scoring

Mapped CWE(s)

• CWE-94 : Improper Control of Generation of Code ('Code Injection')

All CAPEC(s)

CAPEC(s) with Mapped TTPs

Mapped ATT&CK TTPs

• T1027.006 : HTML Smuggling
  Kill Chain: defense-evasion
• T1027.009 : Embedded Payloads
  Kill Chain: defense-evasion
• T1564.009 : Resource Forking
  Kill Chain: defense-evasion

Malware

APTs Threat Group Associations

Campaigns

Affected Products

• cpe:2.3:a:microsoft:excel:2002:sp3:*:*:*:*:*:*
• cpe:2.3:a:microsoft:excel:2007:sp1:*:*:*:*:*:*
• cpe:2.3:a:microsoft:excel:2007:sp2:*:*:*:*:*:*
• cpe:2.3:a:microsoft:office:2004:*:mac:*:*:*:*:*
• cpe:2.3:a:microsoft:office:2008:*:mac:*:*:*:*:*
• cpe:2.3:a:microsoft:open_xml_file_format_converter:*:*:mac:*:*:*:*:*
• cpe:2.3:a:microsoft:office_compatibility_pack:2007:sp1:*:*:*:*:*:*
• cpe:2.3:a:microsoft:office_compatibility_pack:2007:sp2:*:*:*:*:*:*

← Back to Home