CVE-2014-1756

Untrusted search path vulnerability in Microsoft Office 2007 SP3, 2010 SP1 and SP2, and 2013 Gold, SP1, RT, and RT SP1, when the Simplified Chinese Proofing Tool is enabled, allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .docx file, aka "Microsoft Office Chinese Grammar Checking Vulnerability."

CVSS v2.0 9.3 HIGH

9.3^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-023
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-023

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:microsoft:office:2007:sp3::::::
	cpe:2.3:a:microsoft:office:2010:sp1:x64:::::*
	cpe:2.3:a:microsoft:office:2010:sp1:x86:::::*
	cpe:2.3:a:microsoft:office:2010:sp2:x64:::::*
	cpe:2.3:a:microsoft:office:2010:sp2:x86:::::*
	cpe:2.3:a:microsoft:office:2013:::::::*
	cpe:2.3:a:microsoft:office:2013:sp1::::::

History

21 Nov 2024, 02:04

Type	Values Removed	Values Added
References	~~() https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-023 -~~	() https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-023 -

Information

Published : 2014-05-14 11:13

Updated : 2024-11-21 02:04

NVD link : CVE-2014-1756

Mitre link : CVE-2014-1756

CVE.ORG link : CVE-2014-1756

JSON object : View

Products Affected

microsoft

office

CWE

NVD-CWE-Other

{"id": "CVE-2014-1756", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2014-05-14T11:13:06.210", "references": [{"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-023", "source": "secure@microsoft.com"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-023", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Untrusted search path vulnerability in Microsoft Office 2007 SP3, 2010 SP1 and SP2, and 2013 Gold, SP1, RT, and RT SP1, when the Simplified Chinese Proofing Tool is enabled, allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .docx file, aka \"Microsoft Office Chinese Grammar Checking Vulnerability.\""}, {"lang": "es", "value": "Vulnerabilidad de ruta de b\u00fasqueda no confiable en Microsoft Office 2007 SP3, 2010 SP1 y SP2 y 2013 Gold, SP1, RT y RT SP1, cuando la herramienta de correcci\u00f3n de chino simplificado est\u00e1 habilitado, permite a usuarios locales ganar privilegios a trav\u00e9s de un DLL de caballo de troya en el directorio de trabajo actual, tal y como fue demostrado por un directorio que contiene un archivo .docx, tambi\u00e9n conocido como 'Vulnerabilidad de correcci\u00f3n de gram\u00e1tica china de Microsoft Office.'"}], "lastModified": "2024-11-21T02:04:58.587", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FEECD12A-5BEF-4675-B62E-86CF4A7474D7"}, {"criteria": "cpe:2.3:a:microsoft:office:2010:sp1:x64:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8239CEF1-BD02-4ACE-A0C2-75A9EAA15914"}, {"criteria": "cpe:2.3:a:microsoft:office:2010:sp1:x86:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8383FADC-9391-4570-AAF9-92A952A4F04F"}, {"criteria": "cpe:2.3:a:microsoft:office:2010:sp2:x64:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "69998A67-CB15-4217-8AD6-43F9BA3C6454"}, {"criteria": "cpe:2.3:a:microsoft:office:2010:sp2:x86:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "349E9084-8116-43E9-8B19-CA521C96660D"}, {"criteria": "cpe:2.3:a:microsoft:office:2013:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E926E35D-02F6-4EA0-83C5-31443D3A0F01"}, {"criteria": "cpe:2.3:a:microsoft:office:2013:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "120690A6-E0A1-4E36-A35A-C87109ECC064"}], "operator": "OR"}]}], "evaluatorComment": "Per: http://cwe.mitre.org/data/definitions/426.html \"CWE-426: Untrusted Search Path\"", "sourceIdentifier": "secure@microsoft.com"}