16/02/2024, 19:17 CERT-In Vulnerability Notes

CERT-In Vulnerability Note CIVN-2024-0046

Remote Code Execution Vulnerability in Microsoft Outlook

Original Issue Date:February 15, 2024

Severity Rating: CRITICAL

Software Affected

Microsoft Office 2016 for 32-bit edition and 64-bit editions

Microsoft Office LTSC 2021 for 32-bit editions and 64-bit editions
Microsoft 365 Apps for Enterprise for 32-bit edition and 64-bit editions
Microsoft Office 2019 for 32-bit edition and 64-bit editions

Overview

A vulnerability has been reported in Microsoft Outlook which could be exploited by a remote attacker to execute arbitrary code
on a targeted system.

Description

This vulnerability exists in Microsoft Outlook due to improper neutralization of user-supplied input by the Preview Pane feature.
A remote attacker could exploit this vulnerability by enticing a victim to open a specially-crafted file.

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code with elevated privileges on
the targeted system.

Solution

Apply appropriate security updates as mentioned in the below link:

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21413

Vendor Information

Microsoft
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21413

References

Microsoft
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21413

CVE Name
CVE-2024-21413

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)

Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India

about:blank 1/1