CVE-2017-0199
HIGHCVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
5Tags
Description
Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API."
Analysis
Microsoft Office and WordPad allow remote code execution via crafted documents that exploit Windows API handling of OLE objects, weaponized by multiple APT groups and ransomware campaigns as a primary spear-phishing delivery mechanism.
Technical Context
The vulnerability allows HTA (HTML Application) content to be executed through OLE objects embedded in Office documents. When a user opens a crafted RTF document, the OLE object triggers a download and execution of an HTA file via the URL Moniker, bypassing typical macro-based restrictions.
Affected Products
['Microsoft Office 2007 SP3', 'Microsoft Office 2010 SP2', 'Microsoft Office 2013 SP1', 'Microsoft Office 2016', 'Microsoft Windows Vista SP2 through Windows 10']
Remediation
Apply Microsoft security update. Disable URL Moniker-based OLE activation via registry. Block RTF files at email gateways. Enable Protected View for all external documents.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today