Microsoft Office Groove 'Workspace Shortcut' Arbitrary Code Execution Vulnerability

Bugtraq ID:	101531
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 28 2017 12:00AM
Updated:	Sep 28 2017 12:00AM
Credit:	Eduardo Braun Prado
Vulnerable:	Microsoft Windows XP 0 Microsoft Windows Vista 0 Microsoft Windows Server 2008 0 Microsoft Windows Server 2003 0 Microsoft Windows 7 0 Microsoft Office Groove 0
Not Vulnerable:

Microsoft Office Groove 'Workspace Shortcut' Arbitrary Code Execution Vulnerability

Microsoft Office Groove is prone to an arbitrary code-execution vulnerability.

Attackers can exploit this vulnerability to execute arbitrary code in the context of the affected application.

Microsoft Office Groove 'Workspace Shortcut' Arbitrary Code Execution Vulnerability

The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.

Microsoft Office Groove 'Workspace Shortcut' Arbitrary Code Execution Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Microsoft Office Groove 'Workspace Shortcut' Arbitrary Code Execution Vulnerability

References:

• Microsoft Homepage (Microsoft)
  
• Microsoft Office 2007 Groove Security Bypass / Code Execution (cxsecurity.com)