CVE-2014-1761, Oh did you mean CVE-2012-2539?
Summary: Cisco Talos reported that the in-the-wild Microsoft Word RTF 0-day labeled CVE-2014-1761 was actually CVE-2012-2539, released December 11, 2012 in Microsoft Security Bulletin MS12-079, for which Talos had already written Snort rules 24974 and 24975 in December 2012. The exploitation vector is the RTF listoverridecount element, whose only legal values are 0, 1 or 9, and Talos updated its Snort rules with new references and issued a non-PUA ClamAV signature referencing CVE-2014-1761.
Why it matters: The exploit that attackers built or bought for this 0-day does not work against Sourcefire/Cisco customers, because detection for the same listoverridecount flaw has been in place since December 2012.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2012-0158CVE-2012-2539CVE-2014-1761
- Related
- Digital Quartermaster Scenario Demonstrated in Attacks Against the Mongolian Government Cyber Risks ·CVE-2012-2539: Microsoft Word Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Mar 28, 2022