Microsoft Outlook for Mac 2011 allows remote attackers to spoof web content via a crafted email with specific HTML tags, aka "Microsoft Browser Spoofing Vulnerability."

The Microsoft Office application, Office Web Apps, or SharePoint Server installed on the remote Windows host is missing a security update. It is, therefore, affected by multiple vulnerabilities :

  - An arbitrary code execution vulnerability exists in     Microsoft Outlook due to improper parsing of email     messages. An unauthenticated, remote attacker can     exploit this, via a specially crafted email message, to     execute arbitrary code. (CVE-2017-0106)

  - An information disclosure vulnerability exists in     Microsoft Office due to improper handling of objects in     memory. An unauthenticated, remote attacker can exploit     this, by convincing a user to open a specially crafted     Excel file, to disclose the contents of memory.
    (CVE-2017-0194)

  - A cross-site scripting (XSS) vulnerability exists in     Office Web Apps Server due to improper validation of     input before returning it to users. An authenticated,     remote attacker can exploit this, via a specially     crafted request, to execute arbitrary script code in a     user's browser session. (CVE-2017-0195)

  - An arbitrary code execution vulnerability exists in     Microsoft Office due to improper validation of input     before loading dynamic link library (DLL) files. An     unauthenticated, remote attacker can exploit this, by     convincing a user to open a specially crafted Office     document, to execute arbitrary code. (CVE-2017-0197)

  - An arbitrary code execution vulnerability exists in     Microsoft Office and Windows WordPad due to improper     validation of user-supplied input. An unauthenticated,     remote attacker can exploit this, by convincing a user     to open a specially crafted file, to execute arbitrary     code. Note that this vulnerability is being utilized to     spread the Petya ransomware. (CVE-2017-0199)

  - A security feature bypass vulnerability exists in     Microsoft Office due to improper parsing of file     formats. An unauthenticated, remote attacker can exploit     this, by convincing a user into opening a specially     crafted file, to bypass security features.
    (CVE-2017-0204)

  - A spoofing vulnerability in Microsoft Outlook due to     improper validation of input passed via HTML tags. An     unauthenticated, remote attacker can exploit this, by     sending an email with specific HTML tags, to display a     malicious authentication prompt and gain access to a     user's authentication information or login credentials.
    (CVE-2017-0207)

The Microsoft Office application installed on the remote macOS or Mac OS X host is missing a security update. It is, therefore, affected by a spoofing vulnerability in Microsoft Outlook due to improper validation of input passed via HTML tags. An unauthenticated, remote attacker can exploit this, by sending an email with specific HTML tags, to display a malicious authentication prompt and gain access to a user's authentication information or login credentials.

ID	Name	Product	Family	Severity
99314	Security Update for Microsoft Office Products (April 2017) (Petya)	Nessus	Windows : Microsoft Bulletins	high
99313	Security Update for Microsoft Office (April 2017) (macOS)	Nessus	MacOS X Local Security Checks	medium

Detections

Analytics

CVE-2017-0207

medium

Tenable Plugins

high

medium