Skip to content
OpenAdvisories
Critical MSRC-CVE-2022-37958 1 CVE

SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability

Published Sep 13, 2022 · Updated Mar 23, 2023 · Revision 3

Summary

Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

What is SPNEGO Extended Negotiation?
The SPNEGO Extended Negotiation Security Mechanism (NEGOEX) extends Simple and Protected GSS-API Negotiation Mechanism (SPNEGO) described in [RFC4178]. Please see SPNEGO Overview for more information.

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to prepare the target environment to improve exploit reliability.

Are the updates for the Microsoft Office for Mac currently available?
The security update for Microsoft Office 2019 for Mac and Microsoft Office LTSC for Mac 2021 are not immediately available. The updates will be released as soon as possible, and when they are available, customers will be notified via a revision to this CVE information.

Security updates
10.0.17763.3406 — https://support.microsoft.com/help/5017315
10.0.19043.2006 — https://support.microsoft.com/help/5017308
10.0.20348.1006 — https://support.microsoft.com/help/5017316
10.0.20348.916 — https://support.microsoft.com/help/5017392
10.0.22000.978 — https://support.microsoft.com/help/5017328
10.0.10240.19444 — https://support.microsoft.com/help/5017327
10.0.14393.5356 — https://support.microsoft.com/help/5017305
6.1.7601.26115 — https://support.microsoft.com/help/5017361
6.1.7601.26115 — https://support.microsoft.com/help/5017373
6.3.9600.20571 — https://support.microsoft.com/help/5017367
6.3.9600.20571 — https://support.microsoft.com/help/5017365
6.2.9200.23865 — https://support.microsoft.com/help/5017370
6.2.9200.23865 — https://support.microsoft.com/help/5017377

Vulnerabilities 1

Revision history

  1. #3

    Updated one or more CVSS scores for the affected products. This is an informational change only.

  2. #2

    Updated the severity, impact, and CVSS rating from Important Information Disclosure to Critical Remote Code Execution. Added an acknowledgement. These are informational changes only.

  3. #1

    Information published.

References