PRO TIP: OpenSSL Vulnerabilities in Microsoft Office

Brand new installations of Microsoft Office (as of version 18.2205.1091) contain vulnerable versions of OpenSSL libraries, namely ssleay32.dll version 1.0.2j. This version of OpenSSL is referenced in the following CVEs:

• CVE-2016-7055
• CVE-2017-3721
• CVE-2017-3731
• CVE-2017-3735
• CVE-2017-3736
• CVE-2017-3737
• CVE-2017-3738

This library is used for ODBC connections to Amazon Redshift databases for Excel and, if applicable, Power BI. The DLL can be found in the following directory post installation:

C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib

We are attempting to get resolution or further clarification from Microsoft. In the meantime, upgrading the DLL in place to version 1.0.2u resolves the vulnerability findings with no apparent side effects. 

Steps to Reproduce

1. Install Windows 10 Enterprise
   • Version 21H2 Build 19044.1889
2. Apply all system updates
   • As of August 12th, 2022
3. Run baseline vulnerability scan
   • No findings
4. Install Office 365
   • Version 18.2205.1091.0
5. Run vulnerability scan
   • Findings for:
     • CVE-2016-7055
     • CVE-2017-3721
     • CVE-2017-3731
     • CVE-2017-3735
     • CVE-2017-3736
     • CVE-2017-3737
     • CVE-2017-3738
   • All flag C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\ssleay32.dll
6. Update ssleay32.dll in place with build from https://github.com/IndySockets/OpenSSL-Binaries
7. Run vulnerability scan
   • No findings