Microsoft OneNote vulnerability could allow information disclosure
Report ID: MS201303005
Date Published: 13 March 2013
Compromise Type: information-disclosure
Compromise From: remote
Microsoft OneNote 2010
A vulnerability in Microsoft OneNote could expose sensitive information for a configured accounts to an attacker.
Microsoft has released a security update to address a vulnerability in Microsoft OneNote. The vulnerability was caused by a buffer size validation issue; upon successful exploitation, an attacker could be able to view sensitive information such as the username and password of configured accounts.
This issue has been resolved in the latest security update by modifying the way Microsoft OneNote checks the size of a buffer. Users are recommended to install this update to protect their system from possible exploit attempts.
Install the latest security patch for applicable system, available for download from (https://technet.microsoft.com/en-us/security/bulletin/ms13-025)
F-Secure Health Check
F-Secure's free tool, the Health Check, detects if your system is missing the patch for the vulnerability covered in this report.