Skip to main content

Attacks Detected With New Microsoft Office Zero-Day

A new zero-day vulnerability has been discovered affecting all versions of Microsoft Office. The discovery allows attackers to execute code on targeted machines and will also let them install various malware such as Latentbot.
Threat ID:
CC-1318
Category:
Exploit
Threat Severity:
Medium
Threat Vector:
Zero day
Published:
11 April 2017 12:00 AM
Report a cyber attack: call 0300 303 5222 or email [email protected]

This content has been archived

This article no longer conforms to NHS Digital's standards for cyber alerts, and may contain outdated or inaccurate information. Use of this information contained in this page is at your own risk

Summary

A new zero-day vulnerability has been discovered affecting all versions of Microsoft Office. The discovery allows attackers to execute code on targeted machines and will also let them install various malware such as Latentbot.

Affected platforms

The following platforms are known to be affected:

Microsoft Office

  • Microsoft Office - all versions

Threat details

The root cause of the zero-day vulnerability is related to the Windows Object Linking and Embedding (OLE), an important feature of Office.

The flaw is exploited through a specially crafted Microsoft Word RTF (Rich Text Format) file, which contains an embedded OLE2link object. The object instructs Word to send a HTTP request to a remote server controlled by the attackers, to retrieve from it a malicious .hta file masquerading as a RTF file.

A .hta file loads and executes a malicious script that closes Word, downloads additional payloads, and starts Word again and shows a decoy document. Because the .hta is executable, the attacker gains full code execution on the victim’s machine. If Office Protected View is enabled on the target machine, the exploit will not execute and will remain disable

Remediation steps

Type Step
  • Microsoft is aware of this issue and a patch is expected to be released on Tuesday. Ensure any identified vulnerable deployments are included in patch deployment schedules once Microsoft releases its update.
  • Users are encouraged to patch all relevant programs as quickly as possible since attackers are active in exploiting this vulnerability and they know that organisations will take some time in testing the patch after release on Tuesday.

Last edited: 17 February 2020 11:27 am