HIGH Microsoft Corporation Vulnerability Alert

Product:

GDI+

Summary

GDI+ in Microsoft Windows Vista and Server 2008, Office 2003, 2007, and 2010, Office Compatibility Pack, and Lync allows remote attackers to execute arbitrary code via a crafted TIFF image. This vulnerability was exploited in the wild in October and November 2013, particularly through Word documents containing malicious images.

Details

Severity	Base Score	CVE
HIGH	7.8	CVE-2013-3906

Exploitation

To exploit this vulnerability, an attacker can create a specially crafted TIFF image and embed it in a Word document. When the document is opened by a user, the malicious image can trigger the vulnerability in GDI+, allowing the attacker to execute arbitrary code on the victim’s system. User interaction is required to open the document, making social engineering tactics a common method of delivery.

Affected Products

• Microsoft Windows Vista SP2 and Server 2008 SP2
• Office 2003 SP3
• Office 2007 SP3
• Office 2010 SP1 and SP2
• Office Compatibility Pack SP3
• Lync 2010, 2010 Attendee, 2013, and Basic 2013

Mitigation

To mitigate this vulnerability, users should apply the updates provided by Microsoft as per their instructions. Keeping software up to date is crucial in protecting against known vulnerabilities.

References

• McAfee Labs Detects Zero-Day Exploit Targeting Microsoft Office
• CVE-2013-3906: A Graphics Vulnerability Exploited Through Word Documents
• Microsoft Security Advisory 2896666
• Exploit Database Entry for CVE-2013-3906
• Microsoft Security Bulletin MS13-096
• CISA Known Exploited Vulnerabilities Catalog