Detections
Analytics

Security Update for Microsoft Office (April 2017) (macOS)

medium Nessus Plugin ID 99313

Language:

Synopsis

An application installed on the remote macOS or Mac OS X host is affected by a spoofing vulnerability.

Description

The Microsoft Office application installed on the remote macOS or Mac OS X host is missing a security update. It is, therefore, affected by a spoofing vulnerability in Microsoft Outlook due to improper validation of input passed via HTML tags. An unauthenticated, remote attacker can exploit this, by sending an email with specific HTML tags, to display a malicious authentication prompt and gain access to a user's authentication information or login credentials.

Solution

Microsoft has released a patch for Microsoft Outlook for Mac 2011.

See Also

http://www.nessus.org/u?e6f0a227

Plugin Details

Severity: Medium

ID: 99313

File Name: macosx_ms17_apr_office.nasl

Version: 1.7

Type: local

Agent: macosx

Published: 4/12/2017

Updated: 11/13/2019

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2017-0207

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:microsoft:outlook_for_mac

Required KB Items: Host/MacOSX/Version, installed_sw/Microsoft Outlook

Exploit Ease: No known exploits are available

Patch Publication Date: 4/11/2017

Vulnerability Publication Date: 4/11/2017

Reference Information

CVE: CVE-2017-0207

BID: 97463

MSFT: MS17-3212218

MSKB: 3212218