CVE-2015-0085

Vulnerability

A use-after-free vulnerability exists in multiple Microsoft Office products, including Office 2007 SP3, Excel 2007 SP3, PowerPoint 2007 SP3, Word 2007 SP3, Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Word 2010 SP2, Office 2013 Gold and SP1, Word 2013 Gold and SP1, Office 2013 RT Gold and SP1, Word 2013 RT Gold and SP1, Excel Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2, Excel Services on SharePoint Server 2013 Gold and SP1, Word Automation Services on SharePoint Server 2013 Gold and SP1, Web Applications 2010 SP2, Office Web Apps Server 2010 SP2, Web Apps Server 2013 Gold and SP1, SharePoint Server 2007 SP3, Windows SharePoint Services 3.0 SP3, SharePoint Foundation 2010 SP2, SharePoint Server 2010 SP2, SharePoint Foundation 2013 Gold and SP1, and SharePoint Server 2013 Gold and SP1. The flaw occurs during the parsing of specially crafted Office documents, leading to a use-after-free condition in memory handling [1]. An attacker must convince a user to open a malicious file to trigger the vulnerability.

Exploitation

An attacker can exploit this vulnerability by crafting a malicious Office document (e.g., Excel, Word, or PowerPoint file) and delivering it to the targeted user, typically via email or a web download. The user must open the file using an affected Office application. On SharePoint and Office Web Apps, the attacker would need to upload the malicious file and have it processed by the server. No additional authentication or user interaction beyond opening the file is required [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code in the context of the current user. If the user has administrative privileges, the attacker can gain full control of the system, including the ability to install programs, view, change, or delete data, and create new accounts with full user rights [1].

Mitigation

Microsoft released security bulletin MS15-022 on March 10, 2015, which includes updates for all affected products. The update addresses the use-after-free vulnerability by correcting how Office handles objects in memory. For SharePoint and Office Web Apps, the update also improves sanitization of user input. No workarounds are provided. Users should apply the appropriate update from Microsoft Update or via the Microsoft Security Bulletin [1].