Zero-day vulnerability in Microsoft Word
Memory corruption
CVE-2008-2244
The vulnerability was being used in a 2008 Summer Olympics-themed attack.
Vulnerability details
Advisory: SB2008070801 - Remote code execution in Microsoft Word
Vulnerable component: Microsoft Word
CVE-ID: CVE-2008-2244
CVSSv3 score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:F/RL:O/RC:C
CWE-ID: CWE-119 - Memory corruption
Description:
The vulnerability alows a remote attacker to execute arbitrary code on the target system.
The weakness exists due to buffer overflow when handling malformed Word files. A remote attacker can create a specially crafted Word file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.
Note: the vulnerability was being actively exploited.
Known APT campaigns:
Summer Olympics-themed attack
The attack was discovered by TrendMicro. The hackers used malicious Excel file as TROJ_MDROPPER.ZY, and the PowerPoint file as TROJ_PPDROP.M
External links:
https://technet.microsoft.com/en-us/library/security/ms08-042.aspx
https://technet.microsoft.com/library/security/953635
https://isc.sans.edu/diary/Unpatched+Word+Vulnerability/4696
https://blogs.technet.microsoft.com/msrc/2008/07/08/msrc-blog-microsoft-security-advisory-953635/
https://www.cnet.com/news/microsoft-fixes-26-flaws-with-11-patches-six-are-critical/
http://blog.trendmicro.com/trendlabs-security-intelligence/let-the-games-begin/
http://cnii.cybersecurity.my/main/resources/vdb/VDB-1-NWS_JULY_07081.pdf
https://www.mycert.org.my/en/services/advisories/mycert/2008/main/detail/591/index.html