Weaponized Powerpoint in the Wild

Summary: Cisco Talos reported on CVE-2014-4114, a Windows OLE package manager vulnerability published on October 14th that affects all supported Windows versions except Windows XP and allows remote code execution. Attackers crafted a malicious PowerPoint document that extracts two embedded OLE objects, a .inf file and an executable, and the .inf file changes the host system, launches the executable, and adds a registry key to keep the malware running after restart.
What you should know: Talos expects other attackers to adopt this technique because of the simplicity of the attack vector, so a document that looks like an ordinary PowerPoint file can carry both the installer and the payload that survives a reboot.

Read the original at Cisco Talos ↗

Topics: Zero-Days & Exploits
Mentions: CVE-2014-4114
Related: Microsoft Update Tuesday November 2014: Fixes for 3 0-day Vulnerabilities Cyber Risks ·
CVE-2014-4114: Microsoft Windows Object Linking & Embedding (OLE) Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Mar 03, 2022
Microsoft Update Tuesday October 2014: Fixes for 4 0-day Vulnerabilities Cyber Risks ·