Microsoft · Office
A memory corruption flaw in Microsoft Office (2007 SP3, 2010 SP2, 2013 SP1 and 2016) stems from improper handling of objects in memory. An attacker can run arbitrary code in the context of the current user, and exploitation requires a local attack path with no privileges needed but user interaction.
Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11884.
First seen exploited 12 days after disclosure. Public exploit code (Metasploit) was available the same day.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
CVE-2020-0688 exists in Microsoft Office, which is prone to a memory corruption vulnerability allowing an attacker to run arbitrary code if unpatched, in the context of the current user, by failing to properly handle objects in memory. Cyber actors continued to exploit this vulnerability in Microsoft Office. The vulnerability is ideal for phishing campaigns, and it enables RCE on vulnerable systems.
CVE-2020-0688 exists in Microsoft Office, which is prone to a memory corruption vulnerability allowing an attacker to run arbitrary code if unpatched, in the context of the current user, by failing to properly handle objects in memory. Cyber actors continued to exploit this vulnerability in Microsoft Office. The vulnerability is ideal for phasing campaigns, and it enables RCE on vulnerable systems.
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2017-11882 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
…the Equation Editor application is automatically launched to run the embedded objects containing the shellcode to exploit known vulnerabilities described by CVE-2017-11882, CVE-2018-0798 and CVE-2018-0802 — all in Microsoft Office — then downloads the trojan from the hosting server and runs it on the victim's…
2 passages name itOriginal (opens in a new tab) ↗
The infected spreadsheet delivers the threat through vulnerability described under CVE-2017-11882 and CVE-2018-0798.
Even the Word documents attached to emails have used a variety of techniques, including malicious macros, embedded JavaScript and the exploitation of CVE-2017-11882 to install payloads onto the system.
Mentions the CVE; no further detail.
**VenomKit.** VenomKit is a tool that threat actors can use to craft malicious Rich Text File (RTF) documents that exploit multiple vulnerabilities, including CVE-2017–11882, CVE-2018–0802, and CVE-2018–8174.
Files built with this tool are RTF documents exploiting Equation Editor N-day vulnerabilities such as CVE-2017-11882.
RoyalRoad leverages a specific set of vulnerabilities, including CVE-2018-0802, CVE-2018-0798, and CVE-2017-11882, within the Equation Editor of Microsoft Office.
Previously, Cloud Atlas dropped its “validator” implant named “PowerShower” directly, after exploiting the Microsoft Equation vulnerability (CVE-2017-11882) mixed with CVE-2018-0802.
05/11/205/18/205/25/206/1/20 600k 400k 300k 200k 100k 0 Office VBA Macro Social Engineering PowerShell Thread Hijacking WMI Keitaro TDS RIG Exploit Kit VBS PDFGeofencing XL4 MacroRegsvr32 Compressed Executable ExecutableHTML Scheduled Task BITS Jobs Threadkit BlackTDS LCG Kit CVE-2014-0515 CVE-2017-11882…
2 passages name itOriginal (opens in a new tab) ↗
To deliver their malware, the cyber criminals use spearphishing emails with various types of attachments: MS Office documents or spreadsheet files exploiting some known vulnerability like CVE-2017-11882, or documents with Ole2Link and SCT.
Specially-crafted documents, exploiting Office vulnerabilities such as CVE-2017-11882 and CVE-2017-8570, have been leveraged, even in present day campaigns.
…leveraged the Microsoft Office vulnerability CVE-2017-11882 to deploy POWRUNER and BONDUPDATER less…
Mentions the CVE; no further detail.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.