Microsoft has patched as many as 4 vulnerabilities in its Office suite that features Word, Excel, EnergyPoint, Outlook in addition to Office Web, Check Point Research mentioned on Tuesday. These vulnerabilities may permit an attacker to impression customers via malicious Office paperwork. The cybersecurity agency recognized the safety loopholes utilizing an automatic software program approach known as “fuzzing” and reported them to Microsoft in February. While three of the vulnerabilities had been fastened final month, the corporate was capable of patch the final one earlier on Tuesday. Users are advisable to replace the Microsoft Office suite on their desktops and laptops.
Check Point Research mentioned that the loopholes existed in the MSGraph part that is part of Microsoft Office merchandise together with Word, Outlook, EnergyPoint, and Excel, amongst others. The code that the researchers examined and located to be impacted by the vulnerabilities existed since at the least the Office 2003 launch launched in August 2003.
“To our knowledge, this component has not received too much attention from the security community until now, making it a fertile ground for bugs,” the Check Point Research famous in a weblog submit.
The researchers used the “fuzzing” approach to use the vulnerabilities utilizing automated software program. By utilizing the approach, it was discovered that many of the Microsoft Office merchandise had been weak to assaults utilizing malicious code. This could possibly be delivered to customers via a specifically crafted Word doc in .docx format, Outlook Email in .eml, or an Excel spreadsheet in the .xls format.
“We learned that the vulnerabilities are due to parsing mistakes made in legacy code,” mentioned Yaniv Balmas, Head of Cyber Research at Check Point Software, in a ready assertion. One of the first learnings from our analysis is that legacy code continues to be a weak hyperlink in the safety chain, particularly in advanced software program like Microsoft Office.”
The researchers famous that there could possibly be a number of assault vectors, and the best one could be when a sufferer downloads a malicious .xls file.
Check Point Research mentioned that it disclosed the 4 vulnerabilities to Microsoft on February 28. Three of those which are categorised as CVE-2021-31174, CVE-2021-31178, and CVE-2021-31179 had been patched by the software program large on May 11, whereas the final one that’s recognized as CVE-2021-31939 was fastened on Tuesday.
The researchers at Check Point Research consider that whereas Microsoft has fastened the 4 vulnerabilities, there could possibly be some others that will impression customers. It is, subsequently, advisable to put in the newest Microsoft Office suite. Windows 10 customers can particularly set up the replace by going to Settings > Update & safety > Windows Update.
(*4*)Source hyperlink
