CVE-2017-8570
HIGHCVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
5Description
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Microsoft Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-0243.
Analysis
Microsoft Office allows remote code execution through crafted documents that exploit the Composite Moniker vulnerability, enabling arbitrary DLL loading and code execution without user interaction beyond opening the file.
Technical Context
The vulnerability exploits Office's OLE Composite Moniker processing to load and execute arbitrary scriptlet (.sct) files. A crafted document triggers the moniker resolution, downloading and executing an HTA or scriptlet from an attacker's server.
Affected Products
['Microsoft Office (multiple versions affected)']
Remediation
Apply Microsoft security update. Block OLE object activation in Office via registry. Implement email gateway filtering for files containing OLE objects.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today