MS-Office is affected with critical zero day vulnerability; Allows hackers to take full control of y

A Critical MS Office Zero-day Remote Code Execution Vulnerability discovered in Microsoft Office that could allow attacker to take complete control of infected Windows Operating System and this vulnerability has been affected with all version of Microsoft Office.

This Zero-day vulnerability discovered in Office Open XML parser where Microsoft Office software fails to properly handle objects in memory.

Using this flow attacker could take full control of victims machine by run arbitrary code in the MS Office installed windows machine.

If the targetted machine running in administrative mode then attackers could take complete control and then install programs; view, change, or delete data; or create new accounts with full user rights.

sadly, this flow has presented in all the Microsoft office version which is running on all the different versions of Microsoft operating system.

How does this Ms-Office Zer0 Day Vulnerability affected.

Initially, Exploit this MS Office Zero-day vulnerability attack will send the malicious file with an affected version of Microsoft Office into victims.

An attacker can send the malicious exploitation file via mail to the user and convince the user to open the file. In this case, the attacker can’t force the user to open the file so that attacker Some Traditional social engineering method to convincing the user.

An Example Scenario, we have an Exploit RTF document containing a DOCX document that exploits this Zero-day Vulnerability within the Office Open XML parser.

This Exploit itself Contains word/document.xml with valid ‘font’ element in the body of the Exploit.

In this case according to ECMA-376 standard for Office Open XML File Formats valid ‘font’ element describing the fonts used in the document must look like this:

Also attacker will apply the popular heap spraying ( heap spraying is a technique used in exploits to facilitate arbitrary code execution) technique with use of ActiveX components to control memory address.

According to Microsoft, The security update addresses the vulnerability by correcting how Microsoft Office handles objects in memory. and assign the CVE-2017-11826 for this MS Office Zero-day vulnerability .

This Flow patched by Microsoft and release the latest Patch update on Tuesday (17 October 2017) along with 62 vulnerabilities Patch.

Some of Major Affected Product

• Microsoft Office Compatibility Pack Service Pack 3

• Microsoft Office Online Server 2016

• Microsoft Office Web Apps Server 2010 Service Pack 2

• Microsoft Office Web Apps Server 2013 Service Pack 1

• Microsoft Office Word Viewer

• Microsoft SharePoint Enterprise Server 2016

• Microsoft Word 2007 Service Pack 3

• Microsoft Word 2010 Service Pack 2 (32-bit editions)

• Microsoft Word 2010 Service Pack 2 (64-bit editions)

• Microsoft Word 2013 RT Service Pack 1

• Microsoft Word 2013 Service Pack 1 (32-bit editions)

• Microsoft Word 2013 Service Pack 1 (64-bit editions)

• Microsoft Word 2016 (32-bit edition)

• Microsoft Word 2016 (64-bit edition)

• Word Automation Services

• Word Automation Services

Exploit for CVE-2017-11826

• MSWord.Agent.ix;

• MSOffice.CVE-2017-11826.a;

• HEUR:Exploit.MSOffice.Generic.

Note: All the content taken from gbhackers.com