CVE-2017-11774
HIGHCVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
5Description
Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles objects in memory, aka "Microsoft Outlook Security Feature Bypass Vulnerability."
Analysis
Microsoft Outlook 2010 through 2016 allows security feature bypass enabling arbitrary command execution through crafted documents, exploited by APT33 (Elfin) to execute commands directly from Outlook without macro warnings.
Technical Context
The CWE-119 vulnerability allows attackers to bypass Outlook's security restrictions by crafting content that triggers command execution through the Office object handling mechanism. Unlike macro-based attacks, this bypass executes without macro warnings, making it significantly more dangerous.
Affected Products
['Microsoft Outlook 2010 SP2', 'Microsoft Outlook 2013 SP1/RT SP1', 'Microsoft Outlook 2016']
Remediation
Apply Microsoft security update. Implement strict email filtering. Block Office from creating child processes via ASR rules. Monitor for APT33 indicators.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today