Microsoft at the moment rolled out 53 safety patches for the month of November as a part of its common Patch Tuesday replace. One of many fixes addresses CVE-2017-11882, a flaw that has existed, unnoticed, in Microsoft Phrase for the previous 17 years.
The fixes introduced at the moment handle flaws in Home windows, Web Explorer, Workplace, Edge, ASP.NET Core, .NET Core, and Chakra Core. Twenty of the CVEs are labeled Important, 30 are ranked Vital, and three are Average. Three of the bugs at the moment are publicly recognized however none are categorized as being underneath lively assault, and there have been no zero-days this month.
Researchers at Embedi, a agency specializing in safety for embedded gadgets, at the moment launched a report on a 17-year-old distant code execution vulnerability in Microsoft Workplace, which was patched at the moment. They declare it has not been patched and Microsoft didn’t comprehend it existed.
CVE-2017-11882 is a Microsoft Workplace Reminiscence Corruption Vulnerability, Microsoft experiences. It exists in Workplace software program when the software program would not correctly deal with objects in reminiscence. If efficiently exploited, it might let an attacker run arbitrary code within the context of the consumer.
If a consumer has administrative privileges, an attacker who took benefit of this exploit might take management of an contaminated system and set up packages, view and edit knowledge, or create new accounts with full consumer rights. Microsoft says this CVE is extra harmful for administrative customers.
CVE-2017-11882 might be exploited with a phishing assault; victims want solely to open a malicious file with an affected model of Microsoft Workplace or Microsoft WordPad. In a web-based assault, an attacker might host an internet site with a malicious file designed to use the CVE.
The exploit was created by Embedi consultants, who report it really works with all Microsoft Workplace variations launched up to now 17 years, together with Workplace 365. It really works on variations of Microsoft Home windows, together with the Creators Replace, and it is related for all sorts of structure. This flaw would not interrupt a consumer’s work inside Microsoft Workplace, Embedi explains. As soon as the doc is opened, it would not require any additional consumer interplay.
“The one hindrance right here is the protected view mode as a result of it forbids content material execution (OLE/ActiveX/Macro),” researchers say. Nonetheless, this might be bypassed with social engineering. An attacker might, for instance, ask a consumer to save lots of a file to the cloud utilizing OneDrive or Google Drive. When opened, protected view mode wouldn’t be enabled.
Embedi researchers reported the vulnerability to Microsoft in March 2017 and the ultimate repair was issued at the moment.
Greg Wiseman, senior safety researcher at Rapid7, factors out CVE-2017-11882 as one of many flaws which might be particularly harmful.
“No non-browser vulnerabilities are thought of important this month, however with a bit little bit of social engineering, an attacker might theoretically mix one of many Workplace-based RCE vulnerabilities like CVE-2017-11878 or CVE-2017-11882 with a Home windows Kernel privilege escalation weak point comparable to CVE-2017-11847 to realize full management over a system,” he says.
Associated Content material:
Be part of Darkish Studying LIVE for 2 days of sensible cyber protection discussions. Be taught from the business’s most educated IT safety consultants. Try the INsecurity agenda right here.
Kelly Sheridan is Affiliate Editor at Darkish Studying. She began her profession in enterprise tech journalism at Insurance coverage & Know-how and most not too long ago reported for InformationWeek, the place she lined Microsoft and enterprise IT. Sheridan earned her BA at Villanova College. View Full Bio
Extra InsightsClick here for reuse options!
Copyright 2017 NETWORKFIGHTS.COM