Vulners
Lucene search
Microsoft Office OneNote 2007 DLL Hijacking Vulnerability
| Reporter | Title | Published | Views | Family All 18 |
|---|---|---|---|---|
 | The vulnerability of the Microsoft OneNote note-taking software allows a hacker to execute arbitrary code. | 30 Jun 201700:00 | – | bdu_fstec |
 | Microsoft Office DLL Loading Remote Code Execution Vulnerability | 13 Apr 201700:00 | – | cnvd |
 | Microsoft Office DLL Loading (CVE-2017-0197) | 11 Apr 201700:00 | – | checkpoint_advisories |
 | CVE-2017-0197 | 12 Apr 201714:00 | – | cve |
 | CVE-2017-0197 | 12 Apr 201714:00 | – | cvelist |
 | Description of the security update for Office 2010: April 11, 2017 | 11 Apr 201707:00 | – | mskb |
| Security update 2017-04-11 | 11 Apr 201707:00 | – | mskb |
 | KLA10995 Multiple arbitrary code execution vulnerabilities in Microsoft office | 9 Sep 201600:00 | – | kaspersky |
| KLA11024 Defense-in-Depth Update for Microsoft Office | 11 Apr 201700:00 | – | kaspersky |
 | Microsoft OneNote Remote Code Execution Vulnerability | 11 Apr 201707:00 | – | mscve |
10
------------------------------------------------------------------------
Microsoft Office OneNote 2007 DLL side loading vulnerability
------------------------------------------------------------------------
Yorick Koster, September 2015
------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
A DLL side loading vulnerability was found in Microsoft Office OneNote
2007. This issue can be exploited by loading the Microsoft Office
OneNote Mobile ActiveSync Provider for Desktop object as an embedded OLE
object. When instantiating the object Windows will try to load the DLL
ceutil.dll from the current working directory. If an attacker convinces
the user to open a specially crafted (Office) document from a directory
also containing the attacker's DLL file, it is possible to execute
arbitrary code with the privileges of the target user. This can
potentially result in the attacker taking complete control of the
affected system.
------------------------------------------------------------------------
See also
------------------------------------------------------------------------
- CVE-2017-0197
- Microsoft OneNote 2007 Service Pack 3 (3191829)
- Microsoft OneNote 2010 Service Pack 2 (64-bit editions) (2589382)
- Microsoft OneNote 2010 Service Pack 2 (32-bit editions) (2589382)
------------------------------------------------------------------------
Tested versions
------------------------------------------------------------------------
This issue was successfully verified on Windows 7 + Office 2007 32-bit.
------------------------------------------------------------------------
Fix
------------------------------------------------------------------------
Microsoft released updates for Microsoft OneNote 2007 Service Pack 3 and
Microsoft OneNote 2010 Service Pack 2 that fix this vulnerability:
- Microsoft OneNote 2007 Service Pack 3 (3191829)
- Microsoft OneNote 2010 Service Pack 2 (64-bit editions) (2589382)
- Microsoft OneNote 2010 Service Pack 2 (32-bit editions) (2589382)
------------------------------------------------------------------------
Details
------------------------------------------------------------------------
https://www.securify.nl/advisory/SFY20150907/microsoft_office_onenote_2007_dll_side_loading_vulnerability.html
Vulnerability details
It was discovered that Microsoft Office OneNote 2007 is affected by DLL side loading. Loading the Microsoft Office OneNote Mobile ActiveSync Provider for Desktop object (CLSID {F97DE610-BBC2-4F3A-A86D-F261AA2CFC1B}) as an OLE object will result in Windows trying to load the DLL ceutil.dll from the current working directory.
An attacker can exploit this issue by convincing a target user into opening a specially crafted (Office) document from a directory containing the attacker's DLL. This allows for the execution of arbitrary code that will be executed with the privileges of the target user, potentially resulting in a full compromise of the affected system.
# 0day.today [2018-01-04] #Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
12 Apr 2017 00:00Current
6.8Medium risk
Vulners AI Score6.8
EPSS0.27808