erroneo.us
Search all guides⌘K

Digest · Tuesday

Security digest: July 10, 2012

1 editorial brief.

All digests · RSS · Markdown

Take stock

  • Most can relax: VBA CVE-2012-1854: 2012 DLL Loading Bug Joins KEV. Organizations still running Office 2003, 2007 or 2010, or line-of-business and engineering applications that bundle their own old VBE6.dll from the VBA SDK.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Most can relax

· Vulnerability · CVE-2012-1854

VBA CVE-2012-1854: 2012 DLL Loading Bug Joins KEV

This 2012 bug only affects Office 2003, 2007 and 2010 and old copies of the VBA runtime, all patched in 2012 and long out of support; the real job is to find any legacy Office or third-party VBA host that never got the update, and retire it.

Must act: Organizations still running Office 2003, 2007 or 2010, or line-of-business and engineering applications that bundle their own old VBE6.dll from the VBA SDK.

Can relax: Anyone on Microsoft 365 Apps or a supported Office release with no legacy third-party VBA hosts; current Office versions are not listed as affected.

  1. Inventory endpoints for Office 2003, 2007 and 2010 and plan their removal; Office 2010 left extended support in October 2020.
  2. Search for stray copies of VBE6.dll installed by third-party applications and ask those vendors for builds with the updated runtime.
  3. Where legacy Office must stay, confirm the MS12-046 KBs are installed.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.