- Mar 1, 2024
- 952
Microsoft has disclosed a zero-day "max severity" vulnerability that impacts several Office and 356 products. Attackers may exploit this vulnerability to steal private data from individuals or organizations. A patch should be available on August 13th.
The flaw in question, nicknamed "Microsoft Office Spoofing Vulnerability" and tracked as CVE-2024-38200, is relatively easy to exploit. An attacker doesn't need to trick their victim into opening a malicious file or running a bad program. They simply need to guide the victim to a website that contains a "specially crafted file," according to Microsoft.
The following products are impacted by CVE-2024-38200:
Microsoft attributes the discovery of CVE-2024-38200 to PrivSec Consulting's Jim Rush and Synack Red Team's Metin Yunus Kandemir. Evidently, Rush plans to discuss this and other Microsoft Software vulnerabilities at DEF CON 2024 (which runs from August 8th to the 11th).
Individuals who utilize an affected version of Microsoft Office should, as always, avoid opening unknown websites (particularly those shared via email). Organizations may take more aggressive steps the mitigate their risk—Microsoft suggests adding sensitive users to the Protected Users Security Group. Blocking TCP 445/SMB outbound in firewall and VPN settings may also reduce potential exposure. Both of these changes can be reversed after installing Microsoft's security patch, which is tentatively planned for August 13th.
Microsoft is currently working to patch several flaws across the Windows operating system and its first-party apps. One of these flaws, which could let an attacker "unpatch" a system and take advantage of outdated exploits, is particularly interesting and insidious.
www.bleepingcomputer.com
The flaw in question, nicknamed "Microsoft Office Spoofing Vulnerability" and tracked as CVE-2024-38200, is relatively easy to exploit. An attacker doesn't need to trick their victim into opening a malicious file or running a bad program. They simply need to guide the victim to a website that contains a "specially crafted file," according to Microsoft.
The following products are impacted by CVE-2024-38200:
- Microsoft Office 2016 (32-bit & 64-bit)
- Microsoft Office 2016 (32-bit & 64-bit)
- Microsoft Office LTSC 2021 (32-bit & 64-bit)
- Microsoft 365 Apps for Enterprise (32-bit & 64-bit)
Microsoft attributes the discovery of CVE-2024-38200 to PrivSec Consulting's Jim Rush and Synack Red Team's Metin Yunus Kandemir. Evidently, Rush plans to discuss this and other Microsoft Software vulnerabilities at DEF CON 2024 (which runs from August 8th to the 11th).
Individuals who utilize an affected version of Microsoft Office should, as always, avoid opening unknown websites (particularly those shared via email). Organizations may take more aggressive steps the mitigate their risk—Microsoft suggests adding sensitive users to the Protected Users Security Group. Blocking TCP 445/SMB outbound in firewall and VPN settings may also reduce potential exposure. Both of these changes can be reversed after installing Microsoft's security patch, which is tentatively planned for August 13th.
Microsoft is currently working to patch several flaws across the Windows operating system and its first-party apps. One of these flaws, which could let an attacker "unpatch" a system and take advantage of outdated exploits, is particularly interesting and insidious.
Microsoft discloses unpatched Office flaw that exposes NTLM hashes
Microsoft has disclosed a high-severity vulnerability affecting Office 2016 that could expose NTLM hashes to a remote attacker.
