CVE-2024-38169

Heap-based Buffer Overflow (CWE-122)

Published: Aug 13, 2024

010
CVSS 7.8EPSS 0.05%High
CVE info copied to clipboard

Summary

A remote code execution vulnerability exists in Microsoft Office Visio. This vulnerability is classified as a heap-based buffer overflow (CWE-122). The vulnerability affects Microsoft Office Long Term Servicing Channel 2021, Microsoft 365 Apps for Enterprise, and Microsoft Office 2019.

Impact

If successfully exploited, this vulnerability could allow an attacker to execute arbitrary code with the same privileges as the current user. Given the high confidentiality, integrity, and availability impacts, a successful attack could potentially lead to unauthorized access to sensitive information, modification of data, or disruption of system availability. The attack requires user interaction and can be initiated from a local vector, which somewhat limits its scope but doesn't diminish its severity.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

A patch is available for this vulnerability. Microsoft released security updates on August 13, 2024, to address this issue.

Mitigation

1. Apply the security updates provided by Microsoft as soon as possible. 2. Implement the principle of least privilege, ensuring users operate with minimal necessary permissions. 3. Educate users about the risks of opening untrusted files or clicking on suspicious links, as user interaction is required for exploitation. 4. Consider implementing application whitelisting to prevent unauthorized executables from running. 5. Regularly update and patch all Microsoft Office products, especially Visio. 6. Monitor systems for any suspicious activities that might indicate exploitation attempts.

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Timeline

CVSS

A CVSS base score of 7.8 has been assigned.

Aug 13, 2024 at 5:35 PM / microsoft
First Article

Feedly found the first article mentioning CVE-2024-38169. See article

Aug 13, 2024 at 5:47 PM / Vulners.com RSS Feed
CVE Assignment

NVD published the first details for CVE-2024-38169

Aug 13, 2024 at 6:15 PM
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Aug 13, 2024 at 6:23 PM
EPSS

EPSS Score was set to: 0.05% (Percentile: 21.2%)

Nov 19, 2024 at 4:31 PM
Static CVE Timeline Graph

Affected Systems

Microsoft/365_apps
+null more

Patches

Microsoft
+null more

Attack Patterns

CAPEC-92: Forced Integer Overflow
+null more

References

Microsoft August 2024 Security Updates
Classification: Critical, Solution: Official Fix, Exploit Maturity: High, CVSSv3.1: 9.8, CVEs: CVE-2024-21302, CVE-2024-29995, CVE-2024-37968, CVE-2024-38063, CVE-2024-38084, CVE-2024-38098, CVE-2024-38106, CVE-2024-38107, CVE-2024-38108, CVE-2024-38109, CVE-2024-38114, CVE-2024-38115, CVE-2024-38116, CVE-2024-38117, CVE-2024-38118, CVE-2024-38120, CVE-2024-38121, CVE-2024-38122, CVE-2024-38123, CVE-2024-38125 (+82 other associated CVEs), Summary: https://www.bleepingcomputer.com/news/microsoft/microsoft-august-2024-patch-tuesday-fixes-9-zero-days-6-exploited/ Today is Microsoft's August 2024 Patch Tuesday, which includes security updates for 89 flaws, including six actively exploited and three publicly disclosed zero-days. Microsoft is still working on an update for a tenth publicly disclosed zero-day. This Patch Tuesday fixed eight critical vulnerabilities, which were a mixture of elevation of privileges, remote code execution, and information disclosure. The number of bugs in each vulnerability category is listed below:
VERT Threat Alert: August 2024 Patch Tuesday Analysis
While updates for CVE-2024-38200 were released as part of the August Patch Tuesday drop, Microsoft had already enabled a fix for this issue on July 30, meaning that all users of supported versions of Office were protected. This vulnerability, a privilege escalation in the Windows Kernel, requires that the attacker win a race condition to successfully exploit it.

News

Security Updates for Microsoft Office Products C2R (Aug 2024)
An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. An attacker can exploit this to perform actions with the privileges of another user.
CNNVD | 关于微软多个安全漏洞的通报
近日,微软官方发布了多个安全漏洞的公告,其中微软产品本身漏洞84个,影响到微软产品的其他厂商漏洞5个。
Microsoft Office Visio VSDX File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability [CVE-2024-38169]
CVE number = CVE-2024-38169 CVSS Score = 7.8 This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Office Visio. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of VSDX files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Microsoft has issued an update to correct this vulnerability. More details can be found at: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38169 The post Microsoft Office Visio VSDX File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability [CVE-2024-38169] appeared first on SystemTek - Technology news and information .
Microsoft’s August Security Update on High-Risk Vulnerabilities in Multiple Products - Security Boulevard
On August 14, NSFOCUS CERT detected that Microsoft released a security update patch for August, which fixed 90 security issues involving widely used products such as Windows, Microsoft Office, Visual Studio and Azure, including high-risk vulnerabilities such as privilege escalation and remote code execution. Due to an error in the Windows Power Dependency Coordinator after release, local attackers authenticated by ordinary users can exploit this vulnerability by running special programs to obtain SYSTEM permissions of the target system.
ZDI-24-1145: Microsoft Office Visio VSDX File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Office Visio. Microsoft has issued an update to correct this vulnerability.
See 27 more articles and social media posts

CVSS V3.1

Attack Vector:Local
Attack Complexity:Low
Privileges Required:None
User Interaction:Required
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI