Microsoft addresses CVE-2017-11826 Office Zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-11826 | Memory Corruption RCE in Microsoft Office, Word, SharePoint and Office Web Apps Affected versions of Microsoft Office and related server products fail to properly handle objects in memory (CWE-119 memory corruption), allowing remote code execution. The flaw is triggered when a user opens a specially crafted document, for example a malicious Word file delivered by email, with an affected version of Word, Word Viewer, the Office Compatibility Pack, Office 2010, or an affected SharePoint / Office Web Apps / Office Online Server component; the CVSS vector (AV:L, UI:R) reflects this user-interaction requirement. A successful attacker runs arbitrary code in the context of the logged-in user, with high impact on confidentiality, integrity and availability (CVSS 3.1 base 7.8, high). Anyone running Word 2007/2010/2013/2016, Office 2010, Word Viewer, the Office Compatibility Pack, SharePoint Enterprise Server 2010 or SharePoint Server 2010 (including Word Automation Services), Office Web Apps Server 2010 and 2013, Office Web Applications, or Office Online Server is affected. The bug was addressed as an Office zero-day in Microsoft's October 2017 Patch Tuesday release, is listed in the CISA KEV catalog (added 2022-03-03, indicating exploitation in the wild; ransomware use unknown), and EPSS assigns an 81.3% probability of exploitation within 30 days (100th percentile). Do: Apply Microsoft's October 2017 Patch Tuesday security updates to all affected components, including the frequently missed Word Viewer and Office Compatibility Pack, across endpoints, SharePoint 2010 servers, and Office Web Apps/Office Online Server deployments (KEV required action: apply updates per vendor instructions). Until patched, treat unsolicited Word documents and attachments as untrusted and verify users' installed Office builds. Prioritize remediation given confirmed in-the-wild exploitation. | 7.8 | 81% | KEV PoC ×2 |
| masshundreds of millions of desktop Office/Word installations (Microsoft's Office installed base exceeded 1 billion users when the flaw was disclosed), plus tens… |
Full article476 words · extracted from securityaffairs.com · click to collapse
Microsoft October Patch Tuesday addresses the CVE-2017-11826 Office Zero-Day vulnerability that has been exploited in the wild in targeted attacks.
Yesterday we discussed Microsoft’s October Patch Tuesday addressed three critical zero-day security vulnerabilities tied to the DNSSEC protocol.
Going deep in the analysis of the Patch Tuesday updates for October 2017 we can see that Microsoft addressed a total of 62 vulnerabilities, including a critical Office zero-day flaw that has been exploited in the wild in targeted attacks.
The vulnerability, tracked as CVE-2017-11826, is a memory corruption issue affecting all supported versions of Office and was rated as “important.” A remote attacker can exploit the vulnerability to execute arbitrary code by tricking victims into opening a specially crafted file.
“A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. ” reads the security advisory published by Microsoft.
“Exploitation of the vulnerability requires that a user open a specially crafted file with an affected version of Microsoft Office software.”
The vulnerability was spotted by researchers at China-based security firm Qihoo 360 who confirmed to have observed for the first time an attack exploiting this flaw on September 28.
The attacks aimed a small number of the organizations, attackers triggered the CVE-2017-11826 by using malicious RTF files.
“On September 28, 2017, Qihoo 360 Core Security (@360CoreSec) detected an in-the-wild attack that leveraged CVE-2017-11826, an office 0day vulnerability. This vulnerability exists in all the supported office versions. The attack only targeted limited customers. The attacker embedded malicious .docx in the RTF files.” reads the blog post published by Qihoo 360.
“This attack that Qihoo 360 detected in the wild is initiated with RTF (Rich Text Format) files. The RTF file contains highly targeted phishing subfiles to allure user to open.”
According to Qihoo 360, the analysis of the command and control (C&C) server used by the attackers revealed the operation was initiated in August and the first attacks were launched in September.
The campaign observed by Qihoo 360 was spreading a Trojan designed to steal sensitive information from target devices.
The Qihoo 360 researchers added the attack also involved a DLL hijacking vulnerability in a “well-known” security software.
Upon the detection of the CVE-2017-11826 zero-day vulnerability, 360 has released a hot patch which is available in the latest updates. Attacks using office 0day vulnerabilities targeting common users have been increasing since the beginning of 2017.
Experts highlighted that attacks leveraging office zero-day vulnerabilities have been increasing since the beginning of 2017.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(Security Affairs – CVE-2017-11826, Office zero-day)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/64163/hacking/cve-2017-11826-office-zero-day.html