Patchfirst
Patchfirst
CVE-2015-1641 KEVPublic exploit High · 7.8 EPSS 97.2%

Microsoft Office Memory Corruption Vulnerability

Microsoft · Office

Summary

A memory corruption flaw in Microsoft Office affects several products, including Word 2007 SP3, Office 2010 SP2, Word 2013 SP1, Word for Mac 2011, the Office Compatibility Pack SP3, and Word Automation Services and Office Web Apps Server on SharePoint Server 2010 and 2013. An attacker who supplies a crafted RTF document can execute arbitrary code, but only if a user is induced to open or interact with that document.

Official description · NVD

Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, and Office Web Apps Server 2010 SP2 and 2013 SP1 allow remote attackers to execute arbitrary code via a crafted RTF document, aka "Microsoft Office Memory Corruption Vulnerability."

Breakdown
87.4 / 100
Exploited
Yes, in CISA KEV
Reports
4
Tactics
1/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

  1. How attackers get in

  2. What can follow

First seen exploited the day it was disclosed. Public exploit code (PoC-in-GitHub) appeared 6 months after disclosure.

  1. DisclosedFirst seen exploitedVulnCheck KEV evidenceday 0
  2. Public exploit codePoC-in-GitHub+6 mo
  3. Added to CISA KEVEU database agrees+7 yrs

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

2 , grouped by in kill-chain order, 2 cited passages 11

ExecutionTA0002

Exploitation for Client Execution T1203 Medium
MITRE CTID mapping of the CVE · uncategorised
Malicious File T1204.002 Medium
AI mapping from the description · how it is exploited

user opens malicious document triggers exploit

via a crafted RTF document
From the official description (NVD) Original (opens in a new tab) ↗
Lower-confidence links (2)

These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.

  • Process InjectionT1055 CTID attack_to_cve Phase 1 "Uncategorized" mapping (not staged by impact)
  • Drive-by CompromiseT1189 CTID attack_to_cve Phase 1 "Uncategorized" mapping (not staged by impact)

Detection

1 rule for this CVE · 74 general rules for its techniques

Rules for this CVE

1 that reference CVE-2015-1641 directly.

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Malicious FileT1204.00239 general rules
All 39 on SigmaHQ ↗
Exploitation for Client ExecutionT120335 general rules
All 35 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 4 threat reports
4 reportscitizenlab.caTrend Microforcepoint.com+1

Reports are matched by finding the exact id CVE-2015-1641 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

4 links, grouped by NVD tag (3 duplicates merged)

Vendor Advisory 1

docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-033

US Government Resource 1

cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-1641

Third Party Advisory 2

securityfocus.com/bid/73995securitytracker.com/id/1032104
↑ ↓ chooseEnter openEsc close