CVE-2020-0852 RCE Word vuln

Topic

New Reply

So this is a pretty nasty RCE vulnerability, using a specially crafted Word doc which can be triggered just by previewing the doc in Outlook.

Looking at MS’ page on it:

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0852

I’m not seeing Office 2016 (for Windows) in the list. But I’m also not seeing any news on this vuln only applying to Office 2019.

Does anyone here have any more info or links? Trying to work out whether I should be worried about this one or not (we don’t use 2019 yet)

Reply | Quote

Replies

As I mentioned in the main post:

CVE-2020-0852 is his [Dustin Childs’]  top pick for a notable security hole. It’s a bug in Word that can be triggered if you preview a Word document in Outlook. The offered patches are for Office 2019 Click-to-Run, Mac Office 2016, Office Online Server, and Sharepoint Server 2019. Microsoft categorizes it as “Exploitation less likely.”

I don’t have any additional info. Sorry.

This blurb from Office Watch hits the nail on the head:

Sadly, this kind of sloppy documentation of Microsoft security bugs is typical. They are intended to give the impression of disclosure without really informing customers of the true nature of the problem.

2 users thanked author for this post.

schooltech, Elly

Reply | Quote

Hi Woody,

I appreciate you taking the time out to reply; and to also confirm my worst suspicions

2 users thanked author for this post.

Elly, woody

Reply | Quote