CVE-2017-0199Microsoft Office and WordPad Remote Code Execution Vulnerability

Description

Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API."

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

References and patches

• 97498 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
• https://blog.nviso.be/2017/04/12/analysis-of-a-cve-2017-0199-malicious-rtf-document/ ExploitThird Party Advisory
• http://rewtin.blogspot.nl/2017/04/cve-2017-0199-practical-exploitation-poc.html ExploitThird Party Advisory
• 41894 exploitExploitThird Party AdvisoryVDB Entry
• https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199_useda.html Broken LinkExploitThird Party Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0199 PatchVendor Advisory
• https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02 Third Party AdvisoryUS Government Resource
• https://www.mdsec.co.uk/2017/04/exploiting-cve-2017-0199-hta-handler-vulnerability/ ExploitThird Party Advisory
• 41934 exploitExploitThird Party AdvisoryVDB Entry
• 42995 exploitThird Party AdvisoryVDB Entry
• 1038224 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-0199 US Government Resource