CVE-2015-2468
published 2015-08-15CVE-2015-2468: Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office for Mac 2016, Office Compatibility Pack…
PriorityP268critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
29.52%
98.0th percentile
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office for Mac 2016, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, Word Web Apps 2010 SP2, and Office Web Apps Server 2013 SP1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability."
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | office | — | — |
| microsoft | office | — | — |
| microsoft | office | — | — |
| microsoft | sharepoint_server | — | — |
| microsoft | sharepoint_server | — | — |
| microsoft | word | — | — |
| microsoft | word | — | — |
| microsoft | word | — | — |
| microsoft | word_web_apps | — | — |
| microsoft | word_web_apps_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →The vulnerability triggers via a crafted .doc file processed by mso.dll (version 12.0.6721.5000) and wwlib.dll (version 12.0.6720.5000) in Office 2007. Monitor for crashes or suspicious frees originating from mso!Ordinal649 / mso!MsoFreePv call chain. ↗
- →Exploitation requires heap spray to reserve and commit virtual address 0x00019000 in the target process, then place an arbitrary address at offset 0x910 (i.e., 0x00019910) to trigger an arbitrary free. Detect heap spray activity targeting low virtual addresses in WINWORD.EXE. ↗
- →The crash/exploit is triggered when Word is closed after opening the malicious document. Monitor for abnormal WINWORD.EXE termination crashes (access violations in mso.dll) after document open events. ↗
- →The vulnerable code path involves a rep stos instruction writing attacker-influenced data into a structure offset, which is later used as a pointer to free. Look for Application Verifier / PageHeap alerts on mso.dll Ordinal649 in Office 2007 environments. ↗
- ·The PoC crash was observed only with Microsoft Office File Validation Add-In disabled. With the add-in enabled, the malicious document may be blocked before the vulnerable code path is reached. ↗
- ·The bug did not reproduce in Office 2010 on Windows 7 x86 during researcher testing; detection focus should prioritize Office 2007 (mso.dll 12.x / wwlib.dll 12.x) deployments. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No writeups or analysis indexed.
http://www.securitytracker.com/id/1033239https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-081https://www.exploit-db.com/exploits/37912/http://www.securitytracker.com/id/1033239https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-081https://www.exploit-db.com/exploits/37912/
2015-08-15
Published