A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0671, CVE-2019-0673, CVE-2019-0674, CVE-2019-0675.

The Microsoft Office Products are missing security updates. They are, therefore, affected by multiple vulnerabilities:

  - A remote code execution vulnerability exists when the Windows Jet     Database Engine improperly handles objects in memory. An attacker     who successfully exploited this vulnerability could execute     arbitrary code on a victim system. An attacker could exploit this     vulnerability by enticing a victim to open a specially crafted     file. (CVE-2019-0538, CVE-2019-0582)

  - A security feature bypass vulnerability exists when Microsoft     Office does not validate URLs. An attacker could send a victim a     specially crafted file, which could trick the victim into     entering credentials. An attacker who successfully exploited this     vulnerability could perform a phishing attack. (CVE-2019-0540)

  - An information disclosure vulnerability exists when Microsoft     Excel improperly discloses the contents of its memory. An     attacker who exploited the vulnerability could use the     information to compromise the user's computer or data. To exploit     the vulnerability, an attacker could craft a special document     file and then convince the user to open it. An attacker must know     the memory address location where the object was created.
    (CVE-2019-0669)

  - A remote code execution vulnerability exists when the Microsoft     Office Access Connectivity Engine improperly handles objects in     memory. An attacker who successfully exploited this vulnerability     could execute arbitrary code on a victim system. An attacker     could exploit this vulnerability by enticing a victim to open a     specially crafted file. (CVE-2019-0671,  CVE-2019-0672,     CVE-2019-0673,  CVE-2019-0674, CVE-2019-0675)

ID	Name	Product	Family	Type	Severity
162029	Security Updates for Microsoft Office Products C2R (February 2019)	Nessus	Windows	Local	high
122132	Security Updates for Microsoft Office Products (February 2019)	Nessus	Windows : Microsoft Bulletins	Local	high

Detections

Analytics

CVE-2019-0672

high

Tenable Plugins

high

high