Microsoft Word on Android input validation

Summaryinfo

A vulnerability, which was classified as critical, has been found in Microsoft Word on Android. This impacts an unknown function. Performing a manipulation results in input validation. This vulnerability is reported as CVE-2020-1223. The attack is possible to be carried out remotely. No exploit exists. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability, which was classified as critical, was found in Microsoft Word on Android (Word Processing Software) (affected version unknown). This affects an unknown functionality. The manipulation with an unknown input leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A remote code execution vulnerability exists when Microsoft Word for Android fails to properly handle certain files.To exploit the vulnerability, an attacker would have to convince a user to open a specially crafted URL file.The update addresses the vulnerability by correcting how Microsoft Word for Android handles specially crafted URL files., aka 'Word for Android Remote Code Execution Vulnerability'.

The weakness was disclosed 06/09/2020 as confirmed security update guide (Website). The advisory is shared at portal.msrc.microsoft.com. The public release has been coordinated in cooperation with Microsoft. This vulnerability is uniquely identified as CVE-2020-1223. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. The advisory points out:

A remote code execution vulnerability exists when Microsoft Word for Android fails to properly handle certain files.

Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Word Processing Software

Vendor

• Microsoft

Name

• Word

License

• commercial

Website

• Vendor: https://www.microsoft.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion