Remote code
execution vulnerability exists in Microsoft Office software and is caused when
the Office improperly handles objects in memory while parsing specially crafted
Office files. This could corrupt system memory in such a way as to allow an
attacker to execute arbitrary code CVE-2015-0097 .
To
exploit this vulnerability the user has to be tricked into visiting the
attacker's website by clicking on a link. Another scenario could be downloading
and opening specially crafted MS office email attachment. Microsoft Word, Excel
and Powerpoint contains a remote code execution vulnerability because it is
possible to reference documents such as Works document (.wps) as HTML. It will process
HTML and script code in the context of the local machine zone of Internet
Explorer which leads to arbitrary code execution.
Once the
user opens the office document the attacker is able to perform actions in
security context of the logged in user.
When
the user opens that crafted document the code is executed. The code connects to
attacker's server and downloads a file which is saved as .hta in the
\appdata\roaming\microsoft\windows\start menu\programs\startup\ directory.
So
when the user reboots the machine this malicious file which is saved in the
startup directory is executed. This allows remote attacker to execute arbitrary
code via crafted office document aka "Microsoft Word Local Zone Remote
Code Execution Vulnerability."
That's why you might need to check whether your Security Devices are updated in Signature to protect this kind of vulnerability.
Have a good time.
(Be knowledgeable, pass it on then)
Comments
Post a Comment