Office and Windows HTML Remote Code Execution Vulnerability (CVE-2023-36884)

Imechapishwa: Jul 14, 2023 09:05

Advisory No: TZCERT/SA/2023/07/14-01

Source: Microsoft

Software Affected: Microsoft Office and Windows

Overview

Description

Advisory No: TZCERT/SA/2023/07/14-01

Date of First Release: 14th July 2023

Source: Microsoft

Software Affected: Microsoft Office and Windows

Overview:

Microsoft has released security workaround to address a critical vulnerability affecting Microsoft Office and Windows. The vulnerability may allow an attacker to take control of affected system.

Description:

Microsoft Office and Windows are affected with a remote code execution vulnerability. The vulnerability allows the attacker to use a specially crafted Microsoft Office document to perform remote code execution in the context of the victim. However, for the exploit to be successful, the attacker must persuade the victims to open the malicious Office document.

Impact:

Successful exploitation of this vulnerability may allow the attacker to control of the affected system.

Solution:

Microsoft has released a workaround for this vulnerability. Users and administrators are encouraged to apply necessary updates.

References:

  1. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36884
  2. https://securityaffairs.com/148380/hacking/office-zero-day-cve-2023-36884.html

Impact

Solution

References

Subscribe To TZ - CERT Newsletter

A digest of Tanzania Computer Emergency Response Team coverage of cyber-security news across the globe.

Subscribe
Ripoti Tukio