Threat Brief: Office Documents Can Be Dangerous (But We’ll Continue to Use Them Anyway)
Summary: Unit 42 describes five ways Office documents can be weaponized against Windows endpoints: VBA macros that run on open or after a click, embedded Flash objects exploiting flaws like CVE-2018-4878, Microsoft Equation Editor exploits including CVE-2017-11882 and CVE-2018-0802 seen in the wild, and OLE/HTA objects used in CVE-2017-0199 and CVE-2018-8174. The brief notes Equation Editor runs as its own process (eqnedt32.exe), so Office-specific protections such as EMET and Windows Defender Exploit Guard do not cover it by default.
Key Takeaway: The Equation Editor runs outside the Office process, so the exploit protections you applied to Word and Excel do not cover it unless you extended them - a gap attackers reached through CVE-2017-11882 and CVE-2018-0802 in the wild.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Mentions
- CVE-2017-11882CVE-2018-0798CVE-2018-0802CVE-2018-0807CVE-2018-4878
- Related
- Bitter APT adds Bangladesh to their targets Cyber Risks ·My Little Form Book Cyber Risks ·