=====================================================================

                           CERT-Renater

               Note d'Information No. 2014/VULN221
_____________________________________________________________________

DATE                : 15/10/2014

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Microsoft Office version 2007,
                        2010, for Mac 2011,
                     Microsoft Office Compatibility Pack,
                     Microsoft SharePoint Server version 2010,
                     Microsoft Office Web Apps version 2010.

======================================================================
https://technet.microsoft.com/library/security/ms14-061
______________________________________________________________________

MS14-061 Vulnerability in Microsoft Word and Office Web Apps Could Allow
Remote Code Execution

Version: 1.0

Published Date: October 14, 2014


General Information

Executive Summary

This security update resolves one privately reported vulnerability in
Microsoft Office. The vulnerability could allow remote code execution
if an attacker convinces a user to open a specially crafted Microsoft
Word file. An attacker who successfully exploited the vulnerability
could gain the same user rights as the current user. If the current
user is logged on with administrative user rights, an attacker could
then install programs; view, change, or delete data; or create new
accounts with full user rights.
Customers whose accounts are configured to have fewer user rights on
the system could be less impacted than users who operate with
administrative user rights.

This security update is rated Important for supported editions of
Microsoft Word 2007, Microsoft Office 2007, Microsoft Word 2010,
Microsoft Office 2010, Microsoft Office for Mac 2011, Microsoft Office
Compatibility Pack, Word Automation Services, and Microsoft Office Web
Apps Server 2010.


Affected Software

Microsoft Office 2007 Service Pack 3

Microsoft Office 2007 Service Pack 3

Microsoft Office 2010 Service Pack 1 (32-bit editions)

Microsoft Office 2010 Service Pack 1 (64-bit editions)

Microsoft Office 2010 Service Pack 2 (32-bit editions)

Microsoft Office 2010 Service Pack 2 (64-bit editions)

Microsoft Office 2010 Service Pack 1 (32-bit editions)

Microsoft Office 2010 Service Pack 1 (64-bit editions)

Microsoft Office 2010 Service Pack 2 (32-bit editions)

Microsoft Office 2010 Service Pack 2 (64-bit editions)

Microsoft Office for Mac 2011

Microsoft Office Compatibility Pack Service Pack 3

Microsoft SharePoint Server 2010 Service Pack 1

Microsoft SharePoint Server 2010 Service Pack 2

Microsoft Office Web Apps 2010

Microsoft Office Web Apps 2010 Service Pack 1

Microsoft Office Web Apps 2010 Service Pack 2


Vulnerability Information

Microsoft Word File Format Vulnerability - CVE-2014-4117

A remote code execution vulnerability exists in way that Microsoft
Office software parses certain properties of Microsoft Word files. If
an attacker is successful in exploiting this vulnerability, and if the
current user is logged on with administrative user rights, the attacker
could take complete control of the affected system. An attacker could
then install programs; view, change, or delete data; or create new
accounts with full user rights. Users whose accounts are configured to
have fewer user rights on the system could be less impacted than users
who operate with administrative user rights.

To view this vulnerability as a standard entry in the Common
Vulnerabilities and Exposures list, see CVE-2014-4117.

=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================