Microsoft Office 98 on Mac Office 98 File privileges management

Summaryinfo

A vulnerability has been found in Microsoft Office 98 on Mac and classified as problematic. This issue affects some unknown processing of the component Office 98 File Handler. This manipulation causes privileges management. This vulnerability is handled as CVE-1999-1259. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in Microsoft Office 98 on Mac (Office Suite Software) and classified as problematic. Affected by this vulnerability is an unknown part of the component Office 98 File Handler. The manipulation with an unknown input leads to a privileges management vulnerability. The CWE definition for the vulnerability is CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As an impact it is known to affect confidentiality. The summary by CVE is:

Microsoft Office 98, Macintosh Edition, does not properly initialize the disk space used by Office 98 files and effectively inserts data from previously deleted files into the Office file, which could allow attackers to obtain sensitive information.

The issue has been introduced in 06/20/1998. The weakness was released 12/31/1999 as confirmed knowledge base article (Website). It is possible to read the advisory at support.microsoft.com. This vulnerability is known as CVE-1999-1259. The exploitation appears to be easy. Attacking locally is a requirement. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

The vulnerability was handled as a non-public zero-day exploit for at least 559 days. During that time the estimated underground price was around $5k-$25k.

Upgrading to version 2000 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at X-Force (1780). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Office Suite Software

Vendor

• Microsoft

Name

• Office

Version

• 98

License

• commercial

Website

• Vendor: https://www.microsoft.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion