When combining exploits for added effect goes wrong
Summary: Cisco Talos analyzed an email campaign that chained CVE-2017-0199 with an older CVE-2012-0158 exploit in a single infection chain, delivering an RTF file with an Ole2Link to a remote document at multplelabs[dot]com. The attack failed: the first-stage shellcode read the still-open CVE-2017-0199 file first, searched it for the next-stage marker, and crashed Word with a memory access fault instead of executing the intended Ramnit and Lokibot payloads.
Why it matters: The attackers' goal was to skip the Word prompt that warns users about remote content, and Talos notes a single-byte fix to the file-size check would have made the chain work - so the evasion technique is one correction away from being viable against the same unpatched systems.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2012-0158CVE-2017-0199
- Related