Analysis of CVE-2017-11882 Exploit in the Wild
Summary: Palo Alto Networks Unit 42 captured multiple in-the-wild traffic instances exploiting CVE-2017-11882, a stack buffer overflow in Microsoft Equation Editor (eqnedt32.exe) that Microsoft patched on November 14, 2017. The component was compiled on November 9, 2000 and used without recompilation across all supported Office versions; because of how eqnedt32.exe was linked it does not use DEP or ASLR, and Office-specific protections like EMET and Windows Defender Exploit Guard do not apply to it unless applied system-wide. Since November 20, Unit 42 identified thousands of attempted attacks in AutoFocus, most calling cmd.exe directly or using mshta.exe or cscript.exe to run a remote script from an attacker-controlled server.
Bottom line: One in-the-wild sample arrived as a fake invoice email to European organizations and pulled down the FormBook information-stealing Trojan from zilk[.]pw - a 17-year-old, unpatched-by-default component still delivering commodity malware through documents users are trained to open.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2017-11882
- Related
- CVE-2017-11882: Microsoft Office Memory Corruption Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021Bitter APT adds Bangladesh to their targets Cyber Risks ·