Main Vulnerability Database Vulnerabilities #VU5463

Memory corruption in Microsoft products - CVE-2015-1641

Published: January 27, 2017 / Updated: November 20, 2020

Vulnerability identifier: #VU5463

CSH Severity: Critical

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2015-1641

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when handling rich text format files. A remote attacker can create a specially crafted RTF document, trick the victim into opening it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

Affected software

Microsoft Word
Microsoft Office
Microsoft Office Web Apps
Microsoft Office for macOS
Microsoft SharePoint Server

How to mitigate CVE-2015-1641

Install update from vendor's website.

Links to Public Exploits and PoC-codes

Exploit #1893 - rtf_exploit_extractor (Script to extract malicious payload and decoy document from CVE-2015-1641 exploit documents) (March 18, 2020)

External References

https://technet.microsoft.com/en-us/library/security/ms15-033.aspx