Microsoft Word Remote Code Execution Vulnerability (CVE-2015-0097) (Nov 25,2015)

Remote code execution vulnerability exists in Microsoft Office software and is caused when the Office improperly handles objects in memory while parsing specially crafted Office files. This could corrupt system memory in such a way as to allow an attacker to execute arbitrary code CVE-2015-0097.

To exploit this vulnerability the user has to be tricked into visiting the attacker’s website by clicking on a link. Another scenario could be downloading and opening specially crafted MS office email attachment. Microsoft Word, Excel and Powerpoint contains a remote code execution vulnerability because it is possible to reference documents such as Works document (.wps) as HTML. It will process HTML and script code in the context of the local machine zone of Internet Explorer which leads to arbitrary code execution.

Once the user opens the office document the attacker is able to perform actions in security context of the logged in user.

In the following exploit the word document contains embedded html and script code.

When the user opens this document the code is executed. The code connects to attacker’s server and downloads a file which is saved as .hta in the appdataroamingmicrosoftwindowsstart menuprogramsstartup directory.

So when the user reboots the machine this malicious file which is saved in the startup directory is executed. This allows remote attacker to execute arbitrary code via crafted office document aka “Microsoft Word Local Zone Remote Code Execution Vulnerability.”

Dell SonicWALL Threat Research Team has researched this vulnerability and released following signature to protect their customers

• GAV 19554 : Malformed.wps.MP.2

Security News

The SonicWall Capture Labs Threat Research Team gathers, analyzes and vets cross-vector threat information from the SonicWall Capture Threat network, consisting of global devices and resources, including more than 1 million security sensors in nearly 200 countries and territories. The research team identifies, analyzes, and mitigates critical vulnerabilities and malware daily through in-depth research, which drives protection for all SonicWall customers. In addition to safeguarding networks globally, the research team supports the larger threat intelligence community by releasing weekly deep technical analyses of the most critical threats to small businesses, providing critical knowledge that defenders need to protect their networks.