Traps Prevents Microsoft Office Equation Editor Zero-Day CVE-2018-0802
Summary: Unit 42 found an RTF document in the wild on January 3, 2018 exploiting CVE-2018-0802, a stack overflow bug in Equation Editor's parsing of a long font name string in a FONT record, the same class of flaw as CVE-2017-11882. The sample carried two embedded equations, one for each CVE, so it worked unless both patches were applied, and it dropped a DLL to %TEMP%, renamed it to %appdata%\Word\Startup\w.wll for persistence, then dropped and ran tmp.exe from %programdata%\NetWork.
Key Takeaway: Attackers were exploiting CVE-2018-0802 in a zero-day scenario before Microsoft's fix shipped on January 9, 2018, and the sample was built to survive a machine patched for only one of the two Equation Editor flaws.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2017-11882CVE-2018-0802
- Related
- Bitter APT adds Bangladesh to their targets Cyber Risks ·Threat Brief: Office Documents Can Be Dangerous (But We’ll Continue to Use Them Anyway) Cyber Risks ·CVE-2017-11882: Microsoft Office Memory Corruption Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021