====================================================================

                                  CERT-Renater

                      Note d'Information No. 2017/VULN002
_____________________________________________________________________

DATE                : 11/01/2016

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Microsoft Office 2016, Microsoft SharePoint
                      Enterprise Server 2016

=====================================================================


https://technet.microsoft.com/en-us/library/security/MS17-002
____________________________________________________________________

MS17-002 Security Update for Microsoft Office (3214291)

Published Date:	 	January 10, 2017

Version: 		1.0


Executive Summary

This security update resolves a vulnerability in Microsoft Office. The 
vulnerability could allow remote code execution if a user opens a 
specially crafted Microsoft Office file. An attacker who successfully 
exploited the vulnerability could run arbitrary code in the context of 
the current user. Customers whose accounts are configured to have fewer 
user rights on the system could be less impacted than those who operate 
with administrative user rights.

The security update addresses the vulnerability by correcting how 
affected versions of Office and Office components handle objects in memory.

For more information about the vulnerability, see the Vulnerability 
Information section.

For more information about this update, see Microsoft Knowledge Base 
Article 3214291.

Affected Software

Microsoft Office 2016

Microsoft SharePoint Enterprise Server 2016

Vulnerability Information

Microsoft Office Memory Corruption Vulnerability

A remote code execution vulnerability exists in Microsoft Office 
software when the Office software fails to properly handle objects in 
memory. An attacker who successfully exploited the vulnerability could 
run arbitrary code in the context of the current user. If the current 
user is logged on with administrative user rights, an attacker could 
take control of the affected system. An attacker could then install 
programs; view, change, or delete data; or create new accounts with full 
user rights. Users whose accounts are configured to have fewer user 
rights on the system could be less impacted than users who operate with 
administrative user rights.

Exploitation of the vulnerability requires that a user open a specially 
crafted file with an affected version of Microsoft Office software. In 
an email attack scenario an attacker could exploit the vulnerability by 
sending the specially crafted file to the user and convincing the user 
to open the file. In a web-based attack scenario an attacker could host 
a website (or leverage a compromised website that accepts or hosts 
user-provided content) that contains a specially crafted file that is 
designed to exploit the vulnerability. An attacker would have no way to 
force users to visit the website. Instead, an attacker would have to 
convince users to click a link, typically by way of an enticement in an 
email or Instant Messenger message, and then convince them to open the 
specially crafted file.

Note that the Preview Pane is not an attack vector for this 
vulnerability. The security update addresses the vulnerability by 
correcting how Office handles objects in memory.

Vulnerability title	CVE number	Publicly disclosed	Exploited
Microsoft Office Memory Corruption Vulnerability	CVE-2017-0003	No	No

==========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================