Vulnerability CVE-2016-7262

Vulnerability Name:

CVE-2016-7262 (CCN-119271)

Assigned:

2016-12-13

Published:

2016-12-13

Updated:

2018-10-12

Summary:

Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Viewer allow user-assisted remote attackers to execute arbitrary commands via a crafted cell that is mishandled upon a click, aka "Microsoft Office Security Feature Bypass Vulnerability."

CVSS v3 Severity:

7.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
6.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)
4.6 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

4.3 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:P/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

CWE-20

Vulnerability Consequences:

Bypass Security

References:

Source: MITRE
Type: CNA
CVE-2016-7262

Source: CCN
Type: Microsoft Security Bulletin MS16-148
Security Update for Microsoft Office (3204068)

Source: CCN
Type: Microsoft Security Bulletin MS17-013
Security Update for Microsoft Graphics Component (4013075)

Source: CCN
Type: Microsoft Security Bulletin MS17-014
Security Update for Microsoft Office (4013241)

Source: BID
Type: Third Party Advisory, VDB Entry
94660

Source: CCN
Type: BID-94660
Microsoft Office CVE-2016-7262 Remote Code Execution Vulnerability

Source: SECTRACK
Type: Third Party Advisory, VDB Entry
1037441

Source: MS
Type: UNKNOWN
MS16-148

Source: XF
Type: UNKNOWN
ms-excel-cve20167262-sec-bypass(119271)

Source: CCN
Type: CYBERSECURITY & INFRASTRUCTURE SECURITY AGENCY
KNOWN EXPLOITED VULNERABILITIES CATALOG

Vulnerable Configuration:

Configuration 1:

cpe:/a:microsoft:excel:2007:sp3:*:*:*:*:*:*

OR cpe:/a:microsoft:excel:2010:sp2:*:*:*:*:*:*

OR cpe:/a:microsoft:excel:2013:sp1:*:*:*:*:*:*

OR cpe:/a:microsoft:excel:2013:sp1:*:*:rt:*:*:*

OR cpe:/a:microsoft:excel:2016:*:*:*:*:*:*:*

OR cpe:/a:microsoft:excel_viewer:*:*:*:*:*:*:*:*

OR cpe:/a:microsoft:office_compatibility_pack:*:sp3:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:microsoft:excel_viewer:-:*:*:*:*:*:*:*

OR cpe:/a:microsoft:excel:2007:sp3:*:*:*:*:*:*

OR cpe:/a:microsoft:office_compatibility_pack::sp3:*:*:*:*:*:*

OR cpe:/a:microsoft:excel:2010:sp2:*:*:*:*:x64:*

OR cpe:/a:microsoft:excel:2010:sp2:*:*:*:*:x32:*

OR cpe:/a:microsoft:excel:2013:sp1:*:*:*:*:x32:*

OR cpe:/a:microsoft:excel:2013:sp1:*:*:*:*:x64:*

OR cpe:/a:microsoft:excel:2013:sp1:~~rt~~~:*:*:*:*:*

OR cpe:/a:microsoft:excel:2016:*:*:*:*:*:x32:*

OR cpe:/a:microsoft:excel:2016:*:*:*:*:*:x64:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.cisecurity:def:1687	V	Microsoft Office Information Disclosure Vulnerability – CVE-2016-7265 (MS16-148)	2017-02-03
oval:org.cisecurity:def:1688	V	Microsoft Office Security Feature Bypass Vulnerability – CVE-2016-7262 (MS16-148)	2017-02-03

BACK