Cisco Coverage for CVE-2017-0199
Summary: Cisco Talos reported on CVE-2017-0199, an arbitrary code execution vulnerability in Microsoft Office caused by improper handling of Rich Text Format files, which was being actively exploited in the wild to deliver the Dridex banking trojan before Microsoft released a patch on April 11, 2017. Talos observed spam campaigns using phishing emails disguised as scanned images from a Xerox Workcentre device, with attachments named like Scan_005_4102974675.doc that were actually RTF-formatted, and noted that clicking "No" on the Word link-update prompt does nothing because the exploit has already run.
Why it matters: The exploit fires before the user answers Word's prompt, so the one decision point defenders have taught users to make - clicking "No" - provides no protection at all. Talos observed multiple spam campaigns exploiting this flaw, and the attackers varied file suffixes Word natively handles specifically to evade countermeasures that disassociated .RTF files from Word.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2017-0199
- Related
- CVE-2017-0199: Microsoft Office and Word Pad Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021When combining exploits for added effect goes wrong Cyber Risks ·