Microsoft has recently released a bulletin and fix for what they have deemed a critical vulnerability affecting the Office suite of products (which includes SharePoint and its companion Office Web Apps). The vulnerability affects both SharePoint 2010 and 2013 where Word Automation Services have been provisioned (or may be provisioned in the future), and all instances of Office Web Apps (2010 and 2013).

If exploited, these vulnerabilities could lead to remote code execution, which provides attackers with the ability to execute commands on a targeted machine from another. The flaw requires that a user opens or previews specially made rich-text formatted (RTF) data with an affected version of Microsoft Office Software. This RTF could be sent via email or could be hosted on a compromised website.

Users who have fewer user rights will be less impacted than those users who have full administrative rights. If successful, an attacker can take over an entire system – creating new accounts and viewing or altering data – therefore it is extremely important to apply the fix as soon as possible.

As a valued customer of Navantis, we would like to take this opportunity not only to alert you of this vulnerability, but also to offer assistance in applying the fix. Patching SharePoint can be a daunting task even for seasoned SharePoint administrators; having an experienced partner like Navantis at your side is a good strategy for minimizing your SharePoint farm’s downtime during this and any other update. You may also want to take this opportunity to get caught up on service packs or cumulative updates, as the SharePoint platform has no doubt received several updates since we last worked with you.

Please don’t hesitate to reach out to us to schedule a time when Navantis can assess your exposure to this vulnerability and help apply the fix to your SharePoint environment(s).

This post was written by Gord MacLeod
Gordon is a seasoned veteran of portal and knowledge management rubrics, with over 15 years’ experience visioning, defining, and launching enterprise level web based solutions. At Navantis, Gordon is responsible for delivering amazing customer experiences for our customers, along with his team of over 60 SharePoint rock stars. Gord is also a member of Microsoft’s SharePoint Partner Advisory Council.