9 April 2017

Zero-day #5 in 2017 targets Microsoft Word users

Zero-day #5 in 2017 targets Microsoft Word users

McAfee disclosed on Friday information about zero-day exploit (SB2017040901) targeting Microsoft Office users. The malicious file in question is an RTF document with .doc extension and embedded OLE2link object. FireEye confirmed the existence of the vulnerability by posting an acknowledgment in their blog post on April8, 2017.

The attackers use a specially crafted RTF document, which once opened, makes the winword.exe to issue a HTTP request to a remote server to retrieve a malicious .hta file. Currently there are two discovered malicious documents serving this exploit. In both cases, the exploit code terminates the winword.exe process to hide a user prompt generated by the OLE2link.

According to McAfee, vulnerability can be exploited against all versions of Microsoft Word, including Microsoft Office 2016 on Windows 10.

This is the fifth zero-day vulnerability this year, but the first one disclosed by a third party instead of the software vendor and the second one still unpatched.

Microsoft Word is one of the most popular targets for file-based exploits among other Microsoft Office components. The diagram below shows distribution of zero-day vulnerabilities in Microsoft Office components for 2006-2016:


Zero-day vulnerabilities in MS Office (2006-2016)

Hopefully Microsoft will patch this vulnerability during the next Patch Tuesday on April, 11.

We advise all users to install the patch as soon as it is available.

UPDATE

Since there are questions about zero-day vulnerabilities in 2017, I have decided to update this post with this information. So here they are:

CVE-2017-0005 (SB2017031505) - The vulnerability was used by Zirconium cyber-espionage group against older versions of Windows. Reported by Microsoft as a zero-day.

CVE-2017-0022 (SB2017031404) - This vulnerability was used in the AdGholas malvertising campaign and later integrated into the Neutrino exploit kit. The vulnerability was reported to Microsoft in September 2016. The first malware sample, discovered in the wild, is connected with AdGholas campaign in July 2016. The exploit came back again in September 2016 with the Neutrino exploit kit.

CVE-2017-0149 (SB2017031409) – reported by Microsoft as a zero-day. Information about targets was not disclosed yet.

CVE-2017-3881 (SB2017031702) – The vulnerability was disclosed by WikiLeaks in documents dubbed CIA Vault 7. It is believed that this vulnerability was used by CIA agents to penetrate government and corporate networks. Reported by Cisco.

SB2017040901 – The latest zero-day. The earliest attack dates to late January, according to McAfee.

Back to the list

Latest Posts

Week in review: major security incidents in October 9-15

Week in review: major security incidents in October 9-15

The article contains a brief report of cybersecurity incidents for the past week.
16 October 2017
Week in review: major security incidents in October 2-8

Week in review: major security incidents in October 2-8

The article contains a brief report of cybersecurity incidents for the past week.
9 October 2017
Week in review: major security incidents in September 25 – October 1

Week in review: major security incidents in September 25 – October 1

The article contains a brief report of cybersecurity incidents for the past week.
3 October 2017
Featured vulnerabilities
FreeBSD update for WPA2 protocol
Medium Patched | 18 Oct, 2017
Information disclosure in Tor
Low Patched | 17 Oct, 2017

Future events
Location: Na Strži 65/1702, Praha 4
Links: http://financnictvi.konference.cz/

Technologické inovace ve finančním sektoru (FINTECH). Kybernetická bezpečnost, risk management, decision engine, datová analýza, reporting, platformy bezpečnostních technologií, mobilní aplikace v globálním světě financí, projektové řízení, případové studie.
Location: Bajkalská 25/A, Bratislava
Links: http://bdd.exponet.sk/

Explózia dát je nepochybne sprievodným javom súčasnosti. Preto aj problematika bezpečnosti a dostupnosti dát zaznamenáva prevratný rozvoj a jej obsah a rozsah sa mení tiež v súvislosti s vývojom nových technológií. Ochrana dát sa netýka len jednotlivých zariadení, ale aj sietí, online úložísk a služieb. Množstvo dát, portfólio zariadení a úložisk sa tiež významne rozširuje s nástupom internetu vecí. Konferencia sa zameriava na aktuálne trendy a možnosti lepšej ochrany a efektívnej práce s dátami.
Location: Na Strži 65/1702, Praha 4
Links: http://did.konference.cz/

Konference přinese aktuální témata, vystoupení předních odborníků z praxe i z akademického prostředí, případové studie. V popředí zájmu budou big data, data analytics, propojování interních a externích dat, business intelligence, geodata, open data,  big data ve finančnictví, vzdělávání i astronomii.