Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

1/9/2018
04:36 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Microsoft Patches Exploited Office Bug

An Office memory corruption vulnerability is the only CVE reported as under active attack for this month's Patch Tuesday.

Microsoft today released its first wave of Patch Tuesday updates for 2018. This included fixes for a total of 56 CVEs affecting Microsoft Windows, Microsoft Office, Internet Explorer, Microsoft Edge, ChakraCore, ASP.NET, and the .NET Framework. One flaw has been exploited.

Of these 56 vulnerabilities, 16 were ranked Critical, 38 Important, one Moderate and one Low severity. Today's release includes guidance for mitigating speculative execution side-channel vulnerabilities following the news of Meltdown and Spectre attacks.

The exploited bug patched today, CVE-2018-0802, is a Critical remote code execution vulnerability in Microsoft Office that exists when software doesn't properly handle objects in memory. An attacker who successfully exploited this could run code in the context of the current user, which would let them install programs, view and edit data, or create new accounts with full user rights. It's more dangerous for victims with administrative rights.

Exploitation would require a user to open a specially crafted file with an affected version of Microsoft Office or WordPad. A threat actor could conduct a phishing attack by sending the file via email and convincing the target to open it. In a web-based attack, the attacker could host a website (or compromise a website) with a file to exploit the Office bug.

"No details of the attacks are provided by Microsoft, but the lack of industry discussion likely means this is being used in a targeted attack," writes Dustin Childs of Trend Micro's Zero Day Initiative Communications. There are multiple Office flaws patched this month, all of which Childs says "should also be given a high deployment priority."

In its exploitability assessment, Microsoft reports CVE-2018-0802 has been exploited in the wild. It states that at the time of publication, exploitation is unlikely for both its latest software release and older software release. Affected versions range from Microsoft Office 2007 Service Pack 3 to Microsoft Word 2016, 64-bit edition.

Read more details on CVE-2018-0802, including all affected versions of Office, here.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Former CISA Director Chris Krebs Discusses Risk Management & Threat Intel
Kelly Sheridan, Staff Editor, Dark Reading,  2/23/2021
Edge-DRsplash-10-edge-articles
Security + Fraud Protection: Your One-Two Punch Against Cyberattacks
Joshua Goldfarb, Director of Product Management at F5,  2/23/2021
News
Cybercrime Groups More Prolific, Focus on Healthcare in 2020
Robert Lemos, Contributing Writer,  2/22/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Building the SOC of the Future
Building the SOC of the Future
Digital transformation, cloud-focused attacks, and a worldwide pandemic. The past year has changed the way business works and the way security teams operate. There is no going back.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-26854
PUBLISHED: 2021-03-03
Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26412, CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065, CVE-2021-27078.
CVE-2021-26855
PUBLISHED: 2021-03-03
Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26412, CVE-2021-26854, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065, CVE-2021-27078.
CVE-2021-26857
PUBLISHED: 2021-03-03
Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26412, CVE-2021-26854, CVE-2021-26855, CVE-2021-26858, CVE-2021-27065, CVE-2021-27078.
CVE-2021-26858
PUBLISHED: 2021-03-03
Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26412, CVE-2021-26854, CVE-2021-26855, CVE-2021-26857, CVE-2021-27065, CVE-2021-27078.
CVE-2021-27065
PUBLISHED: 2021-03-03
Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26412, CVE-2021-26854, CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27078.