CISA confirmó el 10.09.2024 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 01.10.2024.
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38226; https://nvd.nist.gov/vuln/detail/CVE-2024-38226
Microsoft Publisher Security Feature Bypass Vulnerability
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| Microsoft | Microsoft Office 2019 | 19.0.0 – < https://aka.ms/OfficeSecurityReleases | |
| Microsoft | Microsoft Office LTSC 2021 | 16.0.1 – < https://aka.ms/OfficeSecurityReleases | |
| Microsoft | Microsoft Publisher 2016 | 16.0.0 – < 16.0.5465.1001 | |
| microsoft | office | 19.0.0 – < https://aka.ms/OfficeSecurityReleases | |
| microsoft | office 2019 | — | |
| microsoft | office long term servicing channel | 16.0.1 – < https://aka.ms/OfficeSecurityReleases | |
| microsoft | publisher | 16.0.0 – < 16.0.5465.1001 |
cpe:2.3:a:microsoft:office_2019:-:*:*:*:*:*:x64:*cpe:2.3:a:microsoft:office_2019:-:*:*:*:*:*:x86:*cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:*:x64:*cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:*:x86:*cpe:2.3:a:microsoft:publisher:2016:*:*:*:*:*:x64:*cpe:2.3:a:microsoft:publisher:2016:*:*:*:*:*:x86:*Nuestro sensor honeypot gratuito y de código abierto espera en puertos que su servidor no usa y reporta a una lista compartida los escáneres y atacantes que se conectan.