Malware exploits Office Equation Editor vulnerability (fixed in Nov. 2017)

Topic

New Reply

From https://twitter.com/GossiTheDog/status/932970759491866624: “We have our first malicious CVE-2017-11882 (OLE Equation Editor) doc in the wild […]”

Background info: Office Equation Editor Security Bug Runs Malicious Code Without User Interaction.

CVE-2017-11882 was fixed in November 14, 2017 Microsoft updates.

Reply | Quote

Replies

Tweet from Kevin Beaumont: “CVE-2017-11882 (Word OLE Equation Editor) samples coming in more regularly today. Patch this one.”

Reply | Quote

Please see the following post from @MrBrian for instructions on how to disable the equation editor if you choose to do so.

Please pay special attention to the bittedness (32 bit or 64 bit) of BOTH your version of Office AND Windows before proceeding, so you know which step(s) is/are needed for your situation.

Also, please read the ENTIRE bulletin he refers you to before proceeding, so you can decide if some functionality you’ve come to depend on within Office will be disabled by disabling the equation editor.

1 user thanked author for this post.

MrBrian

Reply | Quote

For those that don’t want to apply the November 2017 Microsoft updates yet, Vulnerability Note VU#421280: Microsoft Office Equation Editor stack buffer overflow contains three other solutions.

Reply | Quote

Spam Campaigns with Malware Exploiting CVE-2017-11882 Spread in Australia and Japan

Reply | Quote