The Return of the Equation Editor Exploit – DIFAT Overflow

guest · Mar 5, 2019

The Return of the Equation Editor Exploit – DIFAT Overflow
March 5, 2019
https://www.mimecast.com/blog/2019/03/the-return-of-the-equation-editor-exploit--difat-overflow/

In the last few months, the Mimecast Research Labs team has seen several unique variants of Microsoft Office Word exploits, more specifically combining the previously-patched memory corruption issue CVE-2017-11882 (AKA the Equation Editor Exploit) [...]
These exploits were chaining what we believed to be an unfixed vulnerability in the Object Linking and Embedding(OLE) file format and the way it’s handled in Microsoft Office Word.

The group was able to exploit this bug to circumvent many security solutions designed to protect data from infestation, including leading sandbox and anti-malware technologies. [...]
Microsoft acknowledged it was unintended behavior, but declined to release a security patch at this time, as the issue on its own does not result in memory corruption or code execution.

In this article, we would like to share how we found a bug in OLE32.dll incorrectly handles Integer Overflow and is used to bypass security solutions and fool parsers. [...]
Click to expand...

Log in or Sign up

The Return of the Equation Editor Exploit – DIFAT Overflow

guest Guest

Log in or Sign up

The Return of the Equation Editor Exploit – DIFAT Overflow

guest Guest

Useful Searches