Microsoft Office 365 ProPlus/2010 SP2/2013 RT SP1/2013 SP1/2016 内存损坏

CVSS 元温度得分	当前攻击价格 (≈)	CTI兴趣分数
6.7	$0-$5k	0.00

在Microsoft Office 365 ProPlus/2010 SP2/2013 RT SP1/2013 SP1/2016中曾发现分类为致命的漏洞。此漏洞会影响未知代码。手动调试的不合法输入可导致内存损坏。使用CWE来声明会导致 CWE-119 的问题。此漏洞的脆弱性 2020-04-14公示人类型为Security Update Guide (Website)所披露。索取公告的网址是portal.msrc.microsoft.com。与供应商合作公开发布。

该漏洞被命名为CVE-2020-0991，攻击可能远程发起，无技术细节可用。该漏洞的知名度低于平均水平，没有可利用漏洞。目前漏洞的结构决定了可能的价格范围为美元价USD $0-$5k。公告指出：

A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

它被宣布为未定义。估计零日攻击的地下价格约为$5k-$25k。

建议采用一个补丁来修正此问题。该漏洞被披露后，立即发表过可能的缓解措施。