A security feature bypass vulnerability exists when Microsoft Office does not validate URLs.An attacker could send a victim a specially crafted file, which could trick the victim into entering credentials, aka 'Microsoft Office Security Feature Bypass Vulnerability'.

The Microsoft Office Products are missing security updates. They are, therefore, affected by multiple vulnerabilities:

  - A remote code execution vulnerability exists when the Windows Jet     Database Engine improperly handles objects in memory. An attacker     who successfully exploited this vulnerability could execute     arbitrary code on a victim system. An attacker could exploit this     vulnerability by enticing a victim to open a specially crafted     file. (CVE-2019-0538, CVE-2019-0582)

  - A security feature bypass vulnerability exists when Microsoft     Office does not validate URLs. An attacker could send a victim a     specially crafted file, which could trick the victim into     entering credentials. An attacker who successfully exploited this     vulnerability could perform a phishing attack. (CVE-2019-0540)

  - An information disclosure vulnerability exists when Microsoft     Excel improperly discloses the contents of its memory. An     attacker who exploited the vulnerability could use the     information to compromise the user's computer or data. To exploit     the vulnerability, an attacker could craft a special document     file and then convince the user to open it. An attacker must know     the memory address location where the object was created.
    (CVE-2019-0669)

  - A remote code execution vulnerability exists when the Microsoft     Office Access Connectivity Engine improperly handles objects in     memory. An attacker who successfully exploited this vulnerability     could execute arbitrary code on a victim system. An attacker     could exploit this vulnerability by enticing a victim to open a     specially crafted file. (CVE-2019-0671,  CVE-2019-0672,     CVE-2019-0673,  CVE-2019-0674, CVE-2019-0675)

The Microsoft Office Viewers and Compatibility Products are missing security updates. It is, therefore, affected by multiple vulnerabilities :

  - A security feature bypass vulnerability exists when     Microsoft Office does not validate URLs. An attacker     could send a victim a specially crafted file, which     could trick the victim into entering credentials. An     attacker who successfully exploited this vulnerability     could perform a phishing attack. The update addresses     the vulnerability by ensuring Microsoft Office properly     validates URLs. (CVE-2019-0540)

  - An information disclosure vulnerability exists when     Microsoft Excel improperly discloses the contents of its     memory. An attacker who exploited the vulnerability     could use the information to compromise the users     computer or data. (CVE-2019-0669)

ID	Name	Product	Family	Severity
162029	Security Updates for Microsoft Office Products C2R (February 2019)	Nessus	Windows	high
122317	Security Updates for Microsoft Office Viewers And Compatibility Products (February 2019)	Nessus	Windows : Microsoft Bulletins	medium
122132	Security Updates for Microsoft Office Products (February 2019)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2019-0540

medium

Tenable Plugins

high

medium

high