Vulnerability: SharePoint 2007, 2010 and 2013MS16-042 CRITICAL - Addressed in Apr 2016 CU

I'm a little behind in blogging about recently released Microsoft Security Bulletins for SharePoint, but I'll attempt to catch up a bit here...

In April 2016, Microsoft released a CRITICAL security bulletin related to vulnerabilities in Microsoft SharePoint Server 2007, 2010 and 2013.  In all identified versions, the vulnerabilities found are identified as Remote Code Execution issues.  Full details can be found here: https://technet.microsoft.com/library/security/MS16-042.

Versions of Microsoft Office are also affected: 2007, 2010, 2013, 2013RT, 2016 and Mac Versions 2011 & 2016.  Microsoft SharePoint Foundation 2010 and Foundation 2013 are not affected by this issue. 


The following services within the identified SharePoint version(s) are specifically affected:

1. Microsoft SharePoint Server 2007 (MOSS)

• Excel Services on Microsoft SharePoint Server 2007 Service Pack 3 (32-bit editions)
• Excel Services on Microsoft SharePoint Server 2007 Service Pack 3 (64-bit editions)

2. Microsoft SharePoint Server 2010

• Excel Services on Microsoft SharePoint Server 2010 Service Pack 2                 
• Word Automation Services on Microsoft SharePoint Server 2010 Service Pack 2

UPDATE: For SharePoint Server 2010 specifically, this update was superseded by the May 2016 cumulative update which fixes an additional security vulnerability. My post on that update can be found here: http://www.trustsharepoint.com/2016/06/vulnerability-sharepoint-2010-ms16-054.html.

3. Microsoft SharePoint Server 2013

• Word Automation Services on Microsoft SharePoint Server 2013 Service Pack 1

4. Microsoft Office Web Apps Server 2010 Service Pack 2

• Microsoft Office Web Apps 2010 Service Pack 2

5. Microsoft Office Web Apps Server 2010 Service Pack 2

• Microsoft Office Web Apps Server 2013 Service Pack 1

Background

According to the official Microsoft Bulletin the following is a summary of the vulnerability:

This security update resolves vulnerabilities in Microsoft Office. The most severe of the vulnerabilities could allow remote code execution if a user opens a specially crafted Microsoft Office file. An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.  The security update addresses the vulnerabilities by correcting how Office handles objects in memory.

Security Resources

• VULNERABILITY DETAILS: All details related to this vulnerability and links specifically to a security update addressing the issue can be found here:  https://technet.microsoft.com/library/security/MS16-042. 

• CU UPDATE: SharePoint updates addressing these vulnerabilities and other issues is available through the following links:
• SharePoint Server 2013 April 2016 Cumulative Update
• SharePoint Server 2010 April 2016 Cumulative Update
• No Cumulative Update is available for SharePoint Server 2007 (MOSS) however the following update specifically addressing the issue is available: Security Update for Excel Services on Microsoft SharePoint Server 2007 - April 2016.  Note: To apply this security update, you must have the release version of Service Pack 3 for Microsoft Office SharePoint Server 2007.

• WORKAROUND: There are no workarounds identified specifically related to Microsoft SharePoint Server at this time.  There are several workarounds related to one of the vulnerabilities identified in the security bulletin which involve preventing users from opening untrusted RTF files by implementing registry customizations.

• REPORTED EXPLOITS: According to Microsoft, at this time there are no reported exploits that have occurred using these vulnerabilities.

Vulnerability Details

Multiple remote code execution vulnerabilities exist in Microsoft Office software when the Office software fails to properly handle objects in memory. There are several vulnerabilities listed in this bulletin, most of which apply only to Microsoft Office.  However, 2 are specifically related to the identified versions of Microsoft SharePoint and details regarding these are available at the National Vulnerability Database:

• Microsoft Office Memory Corruption Vulnerability – CVE-2016-0127 (CRITICAL)
• Microsoft Office Memory Corruption Vulnerability – CVE-2016-0136 (IMPORTANT)

Additional notes from Microsoft:

An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Exploitation of the vulnerabilities requires that a user open a specially crafted file with an affected version of Microsoft Office software. Note that where the severity is indicated as Critical in the Affected Software and Vulnerability Severity Ratings table, the Preview Pane is an attack vector for CVE-2016-0127. In an email attack scenario an attacker could exploit the vulnerabilities by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file that is designed to exploit the vulnerabilities. An attacker would have no way to force users to visit the website. Instead, an attacker would have to convince users to click a link, typically by way of an enticement in an email or Instant Messenger message, and then convince them to open the specially crafted file. The security update addresses the vulnerabilities by correcting how Office handles objects in memory.