Microsoft Patches Exploited Office Bug

Microsoft today released its first wave of Patch Tuesday updates for 2018. This included fixes for a total of 56 CVEs affecting Microsoft Windows, Microsoft Office, Internet Explorer, Microsoft Edge, ChakraCore, ASP.NET, and the .NET Framework. One flaw has been exploited.

Of these 56 vulnerabilities, 16 were ranked Critical, 38 Important, one Moderate and one Low severity. Today's release includes guidance for mitigating speculative execution side-channel vulnerabilities following the news of Meltdown and Spectre attacks.

The exploited bug patched today, CVE-2018-0802, is a Critical remote code execution vulnerability in Microsoft Office that exists when software doesn't properly handle objects in memory. An attacker who successfully exploited this could run code in the context of the current user, which would let them install programs, view and edit data, or create new accounts with full user rights. It's more dangerous for victims with administrative rights.

Exploitation would require a user to open a specially crafted file with an affected version of Microsoft Office or WordPad. A threat actor could conduct a phishing attack by sending the file via email and convincing the target to open it. In a web-based attack, the attacker could host a website (or compromise a website) with a file to exploit the Office bug.

"No details of the attacks are provided by Microsoft, but the lack of industry discussion likely means this is being used in a targeted attack," writes Dustin Childs of Trend Micro's Zero Day Initiative Communications. There are multiple Office flaws patched this month, all of which Childs says "should also be given a high deployment priority."

In its exploitability assessment, Microsoft reports CVE-2018-0802 has been exploited in the wild. It states that at the time of publication, exploitation is unlikely for both its latest software release and older software release. Affected versions range from Microsoft Office 2007 Service Pack 3 to Microsoft Word 2016, 64-bit edition.

Read more details on CVE-2018-0802, including all affected versions of Office, here.