Vulners
Lucene search
Microsoft Word Local Machine Zone Remote Code Execution Vulnerability
| Reporter | Title | Published | Views | Family All 21 |
|---|---|---|---|---|
 | CVE-2015-0097 | 18 Jun 201906:53 | – | circl |
 | Microsoft Office Memory Corruption Vulnerability (CNVD-2015-01632) | 12 Mar 201500:00 | – | cnvd |
 | Microsoft Word Local Zone Remote Code Execution (MS15-022; CVE-2015-0097) | 10 Mar 201500:00 | – | checkpoint_advisories |
 | CVE-2015-0097 | 11 Mar 201510:00 | – | cve |
 | CVE-2015-0097 | 11 Mar 201510:00 | – | cvelist |
 | Microsoft Word - Local Machine Zone Code Execution (MS15-022) | 20 Jul 201500:00 | – | exploitdb |
 | Microsoft Word - Local Machine Zone Code Execution (MS15-022) | 20 Jul 201500:00 | – | exploitpack |
 | MS15-022: Vulnerabilities in Office could allow remote code execution: March 10, 2015 | 10 Mar 201500:00 | – | mskb |
 | KLA10469 Multiple vulnerabilities in Microsoft products | 10 Mar 201500:00 | – | kaspersky |
 | The macro perspective of the office vulnerability, 2010-2018-a vulnerability warning-the black bar safety net | 13 Jun 201900:00 | – | myhack58 |
10
Exploit Title: Microsoft Word Local Machine Zone Remote Code Execution Vulnerability
Date: July 15th, 2015
Exploit Author: Eduardo Braun Prado
Vendor Homepage : http://www.microsoft.com
Version: 2007
Tested on: Microsoft Windows XP, 2003, Vista, 2008, 7, 8, 8.1
CVE: CVE-2015-0097
Original Advisory: https://technet.microsoft.com/library/security/ms15-022
Microsoft Word, Excel and Powerpoint 2007 contains a remote code execution vulnerability because it is possible
to reference documents such as Works document (.wps) as HTML. It will process HTML and script code in the context
of the local machine zone of Internet Explorer which leads to arbitrary code execution.
By persuading users into opening eg. specially crafted .WPS, ".doc ", ".RTF " (with a space at the end)
it is possible to triggerthe vulnerability and run arbitrary code in the context of the logged on Windows user.
Exploit code here :
https://onedrive.live.com/embed?cid=412A36B6D0A9436A&resid=412A36B6D0A9436A%21156&authkey=AA_JVoZcoM5kvOc
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/37657.zip
# 0day.today [2018-02-20] #Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
21 Jul 2015 00:00Current
0.4Low risk
Vulners AI Score0.4
EPSS0.7941