Microsoft Office Equation ASLR Bypass

A remote code execution vulnerability exists in Microsoft Office with embedded Equation objects. A remote attacker can exploit this issue by enticing a target victim to open a specially crafted Office file. Successful exploitation would allow an attacker to bypass the ASLR mechanism and execute...

Microsoft Office Equation Memory Corruption Remote Code Execution (CVE-2018-0802)

A remote code execution vulnerability exists in Microsoft Office Equation Editor. The vulnerability is due to an error in the way Microsoft Office improperly handles objects in memory while parsing specially crafted files. A remote attacker can exploit this issue by enticing a victim to open a...

Microsoft Office Equation Editor Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Microsoft Office CVE-2017-11882', 'Description' = %q Module exploits a flaw in how the Equation Editor that allows an attacker to execute arbitra...

Kaspersky Security Bulletin: Review of the Year 2017

Introduction The end of the year is a good time to take stock of the main cyberthreat incidents that took place over the preceding 12 months or so. To reflect on the impact these events had on organizations and individuals, and consider what they could mean for the overall evolution of the threat...

Threat Analysis: Equation Equals Backdoor

On November 20, 2017 the exploit for CVE-2017-11882 was publicly released, which allowed for code execution in vulnerable versions of Microsoft’s Equation editor. CVE-2017-11882 affects the following versions of Microsoft Office: Microsoft Office 2007 Service Pack 3 Microsoft Office 2010 Service...

Microsoft Office CVE-2017-11882

Module exploits a flaw in how the Equation Editor that allows an attacker to execute arbitrary code in RTF files without interaction. The vulnerability is caused by the Equation Editor, to which fails to properly handle OLE objects in memory. This module requires Metasploit:...

Microsoft Office Memory Corruption Remote Code Execution (CVE-2017-11882)

A remote code execution vulnerability exists in Microsoft Office Equation Editor. The vulnerability is due to an error in the way Microsoft Office improperly handles objects in memory while parsing specially crafted files. A remote attacker can exploit this issue by enticing a victim to open a...

Investigation Report for the September 2014 Equation malware detection incident in the US

Background In early October, a story was published by the Wall Street Journal alleging Kaspersky Lab software was used to siphon classified data from an NSA employee's home computer system. Given that Kaspersky Lab has been at the forefront of fighting cyberespionage and cybercriminal activities ...

Microsoft office component EQNEDT32.EXE memory corruption vulnerability

Microsoft Office is a suite of office software based on the Windows operating system developed by Microsoft. A memory corruption vulnerability exists in EQNEDT32.EXE, the MS Office component of Microsoft office that is responsible for inserting and editing formulas OLE objects in documents...

Microsoft Patches 17-Year-Old Office Bug

Microsoft on Tuesday patched a 17-year-old remote code execution bug found in an Office executable called Microsoft Equation Editor. The vulnerability CVE-2017-11882 was patched as part of Microsoft’s November Patch Tuesday release of 53 fixes. While Microsoft rates the vulnerability only as...

Microsoft Office Equation Editor stack buffer overflow

Overview Microsoft Equation Editor contains a stack buffer overflow, which can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Microsoft Equation Editor is a component that comes with Microsoft Office. It is an out-of-process COM server that ...

Solaris XDR RPC Request Handling RCE (April 2017 CPU) (EBBISLAND / EBBSHAVE)

Binary data rpcebbshave.nbin...

ShadowBrokers Releases NSA UNITEDRAKE Manual

The ShadowBrokers released the manual for UNITEDRAKE, a sophisticated NSA Trojan that targets Windows machines: Able to compromise Windows PCs running on XP, Windows Server 2003 and 2008, Vista, Windows 7 SP 1 and below, as well as Windows 8 and Windows Server 2012, the attack tool acts as a...

CVE-2017-12840

A kernel driver, namely DLMFENC.sys, bundled with the DESLock+ client application 4.8.16 and earlier contains a locally exploitable heap based buffer overflow in the handling of an IOCTL message of type 0x0FA4204. The vulnerability is present due to the kernel driver failing to allocate sufficien...

'Shadow Brokers' Threatens to Unmask A Hacker Who Worked With NSA

The Shadow Brokers, a notorious hacking group that leaked US cyberweapons — which were also abused by the recent ransomware disasters WannaCry and Petya or NotPetya — has now threatened to unmask the identity of a former hacker who worked for the NSA. Besides this, the Shadow Brokers group has al...

suidperl Privilege Escalation (PROCSUID)

The suidperl application is installed on the remote host. It is, therefore, affected by a privilege escalation vulnerability that allows a local attacker to gain root privileges. PROCSUID is one of multiple Equation Group vulnerabilities and exploits disclosed on 2017/04/08 by a group known as th...

Netscape Enterprise Server Basic Authentication Buffer Overflow RCE (EGGBASKET/XP_NS-HTTPD)

According to its banner, the Netscape Enterprise Server running on the remote host is either version 3.6 or 3.6 SP1. It is, therefore, affected by a buffer overflow condition in the HTTP Basic Authentication module of the server. An unauthenticated, remote attacker can exploit this to execute...

Cobalt RaQ4 Administrative Interface backup.cgi Command Execution (EXTINCTSPINACH)

The Cobalt RaQ4 administrative interface running on the remote host is affected by a remote command execution vulnerability in the /cgi-bin/.cobalt/backup/backup.cgi script. An unauthenticated, remote attacker can exploit this to execute arbitrary commands. EXTINCTSPINACH is one of multiple...

More Hacking Groups Found Exploiting SMB Flaw Weeks Before WannaCry

Since the Shadow Brokers released the zero-day software vulnerabilities and hacking tools – allegedly belonged to the NSA's elite hacking team Equation Group – several hacking groups and individual hackers have started using them in their own way. The April's data dump was believed to be the most...

Microsoft Windows MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption Exploit

This Metasploit module is a port of the Equation Group ETERNALBLUE exploit, part of the FuzzBunch toolkit released by Shadow Brokers. There is a buffer overflow memmove operation in Srv!SrvOs2FeaToNt. The size is calculated in Srv!SrvOs2FeaListSizeToNt, with mathematical error where a DWORD is...