ID CVE-2017-0199
Summary Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API."
References
Vulnerable Configurations
  • Microsoft Office 2007 Service Pack 3
    cpe:2.3:a:microsoft:office:2007:sp3
  • cpe:2.3:a:microsoft:office:2010:sp2
    cpe:2.3:a:microsoft:office:2010:sp2
  • Microsoft Office 2013 SP1
    cpe:2.3:a:microsoft:office:2013:sp1
  • Microsoft Office 2016
    cpe:2.3:a:microsoft:office:2016
  • cpe:2.3:o:microsoft:windows_7:-:sp1
    cpe:2.3:o:microsoft:windows_7:-:sp1
  • Microsoft Windows Server 2008 Service Pack 2
    cpe:2.3:o:microsoft:windows_server_2008:-:sp2
  • Microsoft Windows Server 2008 R2 Service Pack 1
    cpe:2.3:o:microsoft:windows_server_2008:r2:sp1
  • Microsoft Windows Server 2012
    cpe:2.3:o:microsoft:windows_server_2012
  • Microsoft Windows Vista Service Pack 2
    cpe:2.3:o:microsoft:windows_vista:-:sp2
CVSS
Base: 9.3 (as of 18-04-2017 - 16:38)
Impact:
Exploitability:
CWE CWE-284
CAPEC
  • Embedding Scripts within Scripts
    An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute scripts. The attacker leverages this capability to execute scripts to execute his/her own script by embedding it within other scripts that the target software is likely to execute. The attacker must have the ability to inject script into script that is likely to be executed. If this is done, then the attacker can potentially launch a variety of probes and attacks against the web server's local environment, in many cases the so-called DMZ, back end resources the web server can communicate with, and other hosts. With the proliferation of intermediaries, such as Web App Firewalls, network devices, and even printers having JVMs and Web servers, there are many locales where an attacker can inject malicious scripts. Since this attack pattern defines scripts within scripts, there are likely privileges to execute said attack on the host. Of course, these attacks are not solely limited to the server side, client side scripts like Ajax and client side JavaScript can contain malicious scripts as well. In general all that is required is for there to be sufficient privileges to execute a script, but not protected against writing.
  • Signature Spoofing by Key Theft
    An attacker obtains an authoritative or reputable signer's private signature key by theft and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
exploit-db via4
  • description Microsoft Excel - OLE Arbitrary Code Execution. CVE-2017-0199. Dos exploit for Windows platform
    file exploits/windows/dos/42995.txt
    id EDB-ID:42995
    last seen 2017-10-17
    modified 2017-09-30
    platform windows
    port
    published 2017-09-30
    reporter Exploit-DB
    source https://www.exploit-db.com/download/42995/
    title Microsoft Excel - OLE Arbitrary Code Execution
    type dos
  • description Microsoft Office Word - Malicious Hta Execution (Metasploit). CVE-2017-0199. Remote exploit for Windows platform. Tags: Metasploit Framework
    file exploits/windows/remote/41934.rb
    id EDB-ID:41934
    last seen 2017-04-25
    modified 2017-04-25
    platform windows
    port
    published 2017-04-25
    reporter Exploit-DB
    source https://www.exploit-db.com/download/41934/
    title Microsoft Office Word - Malicious Hta Execution (Metasploit)
    type remote
  • description Microsoft Office - 'Composite Moniker Remote Code Execution. CVE-2017-8570. Local exploit for Windows platform
    id EDB-ID:44263
    last seen 2018-05-24
    modified 2018-01-09
    published 2018-01-09
    reporter Exploit-DB
    source https://www.exploit-db.com/download/44263/
    title Microsoft Office - 'Composite Moniker Remote Code Execution
  • description Microsoft Word - '.RTF' Remote Code Execution. CVE-2017-0199. Remote exploit for Windows platform
    file exploits/windows/remote/41894.py
    id EDB-ID:41894
    last seen 2017-04-19
    modified 2017-04-18
    platform windows
    port
    published 2017-04-18
    reporter Exploit-DB
    source https://www.exploit-db.com/download/41894/
    title Microsoft Word - '.RTF' Remote Code Execution
    type remote
metasploit via4
description This module creates a malicious RTF file that when opened in vulnerable versions of Microsoft Word will lead to code execution. The flaw exists in how a olelink object can make a http(s) request, and execute hta code in response. This bug was originally seen being exploited in the wild starting in Oct 2016. This module was created by reversing a public malware sample.
id MSF:EXPLOIT/WINDOWS/FILEFORMAT/OFFICE_WORD_HTA
last seen 2018-08-10
modified 2017-08-20
published 2017-04-15
reliability Excellent
reporter Rapid7
source https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/office_word_hta.rb
title Microsoft Office Word Malicious Hta Execution
msbulletin via4
bulletin_SOURCE_FILE https://portal.msrc.microsoft.com/api/security-guidance/en-us/
cves_url https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0199
impact Remote Code Execution
knowledgebase_SOURCE_FILE https://support.microsoft.com/kb/3141529
knowledgebase_id 3141529
name Microsoft Office 2007 Service Pack 3
publishedDate 2017-04-11T07:00:00
severity Critical
nessus via4
  • NASL family Windows : Microsoft Bulletins
    NASL id SMB_NT_MS17-APR_4015551.NASL
    description The remote Windows host is missing security update 4015548 or cumulative update 4015551. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists in the open-source libjpeg image processing library due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit this to disclose sensitive information that can be utilized to bypass ASLR security protections. (CVE-2013-6629) - An information disclosure vulnerability exists in Windows DirectShow due to improper handling of objects in memory. Any unauthenticated, remote attacker can exploit this, by convincing a user to visit a website with specially crafted media content, to disclose sensitive information. (CVE-2017-0042) - Multiple information disclosure vulnerabilities exist in the win32k component due to improper handling of kernel information. A local attacker can exploit these vulnerabilities, via a specially crafted application, to disclose sensitive information. (CVE-2017-0058, CVE-2017-0188) - Multiple flaws exist in Windows Hyper-V Network Switch due to improper validation of input from the guest operating system. A local attacker can exploit these, via a specially crafted application on the guest, to execute arbitrary code on the host system. (CVE-2017-0163, CVE-2017-0180) - A flaw exists in LDAP due to buffer request lengths not being properly calculated. An unauthenticated, remote attacker can exploit this, via specially crafted traffic sent to a Domain Controller, to run processes with elevated privileges. (CVE-2017-0166) - Multiple information disclosure vulnerabilities exist in Windows Hyper-V Network Switch due to improper validation of user-supplied input. A guest attacker can exploit these to disclose sensitive information on the host server. (CVE-2017-0168, CVE-2017-0169) - Multiple denial of service vulnerabilities exist in Windows Hyper-V Network Switch due to improper validation of input from the guest operating system. A local attacker on the guest can exploit these vulnerabilities, via a specially crafted application, to crash the host system. (CVE-2017-0182, CVE-2017-0183, CVE-2017-0185, CVE-2017-0186) - Multiple denial of service vulnerabilities exist in Hyper-V due to improper validation of input from a privileged user on a guest operating system. A local attacker on the guest can exploit these, via a specially crafted application, to cause the host system to crash. (CVE-2017-0184) - A flaw exists in Windows due to improper handling of objects in memory that allows an attacker to cause a denial of service condition. (CVE-2017-0191) - An information disclosure vulnerability exists in the Adobe Type Manager Font Driver (ATMFD.dll) due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted document or visit a malicious web page, to disclose sensitive information. (CVE-2017-0192) - An arbitrary code execution vulnerability exists in Microsoft Office and Windows WordPad due to improper handling of specially crafted files. An unauthenticated, remote attacker can exploit this, by convincing a user to open a malicious file, to execute arbitrary code in the context of the current user. Note that this vulnerability is being utilized to spread the Petya ransomware. (CVE-2017-0199) - A memory corruption issue exists in Internet Explorer in the JScript and VBScript engines due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a malicious website, to execute arbitrary code. (CVE-2017-0201) - A privilege escalation vulnerability exists in Internet Explorer due to a failure to properly enforce cross-domain policies. An unauthenticated, remote attacker can exploit this to inject arbitrary content and gain elevated privileges. (CVE-2017-0210) - A privilege escalation vulnerability exists in Microsoft Windows OLE due to an unspecified failure in integrity-level checks. An authenticated, remote attacker can exploit this to run an application with limited privileges at a medium integrity level. Note that this vulnerability by itself does not allow arbitrary code execution but can be used in conjunction other vulnerabilities. (CVE-2017-0211)
    last seen 2018-09-01
    modified 2018-08-03
    plugin id 99285
    published 2017-04-11
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99285
    title Windows Server 2012 April 2017 Security Updates (Petya)
  • NASL family Windows : Microsoft Bulletins
    NASL id SMB_NT_MS17_APR_OFFICE.NASL
    description The Microsoft Office application, Office Web Apps, or SharePoint Server installed on the remote Windows host is missing a security update. It is, therefore, affected by multiple vulnerabilities : - An arbitrary code execution vulnerability exists in Microsoft Outlook due to improper parsing of email messages. An unauthenticated, remote attacker can exploit this, via a specially crafted email message, to execute arbitrary code. (CVE-2017-0106) - An information disclosure vulnerability exists in Microsoft Office due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted Excel file, to disclose the contents of memory. (CVE-2017-0194) - A cross-site scripting (XSS) vulnerability exists in Office Web Apps Server due to improper validation of input before returning it to users. An authenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary script code in a user's browser session. (CVE-2017-0195) - An arbitrary code execution vulnerability exists in Microsoft Office due to improper validation of input before loading dynamic link library (DLL) files. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted Office document, to execute arbitrary code. (CVE-2017-0197) - An arbitrary code execution vulnerability exists in Microsoft Office and Windows WordPad due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted file, to execute arbitrary code. Note that this vulnerability is being utilized to spread the Petya ransomware. (CVE-2017-0199) - A security feature bypass vulnerability exists in Microsoft Office due to improper parsing of file formats. An unauthenticated, remote attacker can exploit this, by convincing a user into opening a specially crafted file, to bypass security features. (CVE-2017-0204) - A spoofing vulnerability in Microsoft Outlook due to improper validation of input passed via HTML tags. An unauthenticated, remote attacker can exploit this, by sending an email with specific HTML tags, to display a malicious authentication prompt and gain access to a user's authentication information or login credentials. (CVE-2017-0207) - An unspecified flaw exists in Microsoft Office in the Encapsulated PostScript (EPS) filter that allows an attacker to have an unspecified impact. (CVE-2017-2605)
    last seen 2018-09-14
    modified 2018-09-13
    plugin id 99314
    published 2017-04-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99314
    title Security Update for Microsoft Office Products (April 2017) (Petya)
  • NASL family Windows : Microsoft Bulletins
    NASL id SMB_NT_MS17_APR_4015549.NASL
    description The remote Windows host is missing security update 4015546 or cumulative update 4015549. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists in the open-source libjpeg image processing library due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit this to disclose sensitive information that can be utilized to bypass ASLR security protections. (CVE-2013-6629) - An information disclosure vulnerability exists in the win32k component due to improper handling of kernel information. A local attacker can exploit this, via a specially crafted application, to disclose sensitive information. (CVE-2017-0058) - Multiple privilege escalation vulnerabilities exist in the Microsoft Graphics Component due to improper handling of objects in memory. A local attacker can exploit this, via a specially crafted application, to execute arbitrary code with elevated privileges. (CVE-2017-0155, CVE-2017-0156) - A flaw exists in the VBScript engine due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a malicious website or open a specially crafted document file, to execute arbitrary code. (CVE-2017-0158) - Multiple flaws exist in Windows Hyper-V Network Switch due to improper validation of input from the guest operating system. A local attacker can exploit these, via a specially crafted application on the guest, to execute arbitrary code on the host system. (CVE-2017-0163, CVE-2017-0180) - A flaw exists in LDAP due to buffer request lengths not being properly calculated. An unauthenticated, remote attacker can exploit this, via specially crafted traffic sent to a Domain Controller, to run processes with elevated privileges. (CVE-2017-0166) - An information disclosure vulnerability exists in Windows Hyper-V Network Switch due to improper validation of user-supplied input. A guest attacker can exploit this to disclose sensitive information on the host server. (CVE-2017-0168) - Multiple denial of service vulnerabilities exist in Windows Hyper-V Network Switch due to improper validation of input from the guest operating system. A local attacker on the guest can exploit these vulnerabilities, via a specially crafted application, to crash the host system. (CVE-2017-0182, CVE-2017-0183) - A denial of service vulnerability exists in Hyper-V due to improper validation of input from a privileged user on a guest operating system. A local attacker on the guest can exploit this, via a specially crafted application, to cause the host system to crash. (CVE-2017-0184) - A flaw exists in Windows due to improper handling of objects in memory that allows an attacker to cause a denial of service condition. (CVE-2017-0191) - An information disclosure vulnerability exists in the Adobe Type Manager Font Driver (ATMFD.dll) due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted document or visit a malicious web page, to disclose sensitive information. (CVE-2017-0192) - An arbitrary code execution vulnerability exists in Microsoft Office and Windows WordPad due to improper handling of specially crafted files. An unauthenticated, remote attacker can exploit this, by convincing a user to open a malicious file, to execute arbitrary code in the context of the current user. Note that this vulnerability is being utilized to spread the Petya ransomware. (CVE-2017-0199) - A memory corruption issue exists in Internet Explorer due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a malicious website, to execute arbitrary code. (CVE-2017-0202) - A privilege escalation vulnerability exists in Internet Explorer due to a failure to properly enforce cross-domain policies. An unauthenticated, remote attacker can exploit this to inject arbitrary content and gain elevated privileges. (CVE-2017-0210)
    last seen 2018-09-01
    modified 2018-07-30
    plugin id 99304
    published 2017-04-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99304
    title Windows 7 and Windows 2008 R2 April 2017 Security Updates (Petya)
  • NASL family Windows : Microsoft Bulletins
    NASL id SMB_NT_MS17_APR_4014793.NASL
    description The remote Windows host is missing security update KB4014793. It is, therefore, affected by a remote code execution vulnerability in Windows WordPad due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted file, to execute arbitrary code.
    last seen 2018-09-01
    modified 2018-07-30
    plugin id 104044
    published 2017-10-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=104044
    title KB4014793: Microsoft Wordpad Remote Code Execution vulnerability (April 2017)
packetstorm via4
refmap via4
bid 97498
confirm https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0199
misc
sectrack 1038224
saint via4
bid 97498
description Microsoft Word and WordPad RTF HTA handler command execution
id win_patch_office2007,win_patch_office2010,win_patch_office2013,win_patch_office2016
title microsoft_word_wordpad_rtf
type client
the hacker news via4
Last major update 20-04-2017 - 14:23
Published 12-04-2017 - 10:59
Last modified 27-03-2018 - 21:29
Back to Top