Product:
Microsoft Office
Summary
Microsoft Office 2007, 2010, 2013, 2016, and various versions of Windows allow remote attackers to execute arbitrary code via a crafted document. This vulnerability is known as the Microsoft Office/WordPad Remote Code Execution Vulnerability. It affects multiple versions of Microsoft Office and Windows operating systems.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.8 | CVE-2017-0199 |
Exploitation
To exploit this vulnerability, an attacker can create a specially crafted document that, when opened by a user, triggers the execution of arbitrary code. The attacker must convince the user to open the malicious document, which can be delivered via email or other means. Successful exploitation can lead to complete control over the affected system.
Affected Products
- Microsoft Office 2007 SP3: Vulnerable to remote code execution via crafted documents.
- Microsoft Office 2010 SP2: Allows execution of arbitrary code when a malicious document is opened.
- Microsoft Office 2013 SP1: Susceptible to exploitation through specially crafted files.
- Microsoft Office 2016: Can be compromised by opening a malicious document.
- Windows Vista SP2: Vulnerable to remote attacks through crafted documents.
- Windows Server 2008 SP2: Allows remote code execution via malicious documents.
- Windows 7 SP1: Can be exploited by opening a specially crafted document.
- Windows 8.1: Vulnerable to remote code execution through crafted files.
Mitigation
To mitigate this vulnerability, users should apply updates as per the vendor’s instructions. Keeping software up to date is crucial in protecting against known vulnerabilities.
References
- Practical Exploitation of CVE-2017-0199
- SecurityFocus BID 97498
- SecurityTracker ID 1038224
- Analysis of CVE-2017-0199
- ICS-CERT Advisory
- Microsoft Security Advisory
- Exploit DB 41894
- Exploit DB 41934
- Exploit DB 42995
- FireEye Blog on CVE-2017-0199
- MDSec Exploiting CVE-2017-0199
- CISA Known Exploited Vulnerabilities Catalog