Microsoft has released security patches to deal with a 17-year-old flaw that could be exploited to remotely initiate malicious code on all Windows versions.
According to Business Insider, researchers at Embedi discovered the flaw in the Microsoft Equation Editor and describe it as “extremely dangerous.” The vulnerability, which tracked as CVE-2017-11882, was patched in the recent November 2017 Patch Tuesday updates, Bleeping Computer reported. Until the security patches are implemented, IT decision-makers should take additional measures, including monitoring user behavior and turning off potentially exploitable components.
Understanding the Vulnerability
The Microsoft Equation Editor is installed by default on computers that run the Office suite. This tool gives users the ability to insert mathematical equations as Object Linking and Embedding (OLE) items in Microsoft Word documents.
Embedi researchers discovered that the Equation Editor was running an outdated code compiled in November 2000. Although Microsoft replaced in Office 2007 with an updated version, the previous form of Equation Editor remained in newer versions of Office to ensure that users could open documents with calculations created in older versions of the suite, Bleeping Computer noted.
The Equation Editor is unsafe because it runs outside Office and does not use of any of the recent Microsoft security features, such as Control Flow Guard, Threatpost noted. The Embedi researchers found that they could exploit the vulnerability by inserting OLEs into documents and then executing potentially harmful commands remotely.
Discovering the Bug
Researchers discovered the flaw using Microsoft’s BinScope tool, the company’s binary verification mechanism that confirms that files are built in compliance with the Microsoft Security Development Lifecycle requirements.
BinScope allowed Embedi to discover some of the most obsolete elements of Microsoft Office 2016, reported ZDNet. Other Windows components that have not been updated and have transferred between platforms could also be vulnerable to attacks.
The exploit worked across 32-bit and 64-bit architecture types, did not disturb the user’s Microsoft Office workflow and did not require any user interaction.
Security Patches Offer a Fix
To address the Equation Editor flaw, IT managers should download the security patches released by Microsoft. The November 2017 Patch Tuesday updates include includes fixes for 53 security bugs, according to another Bleeping Computer article.
Technology decision-makers should also ensure that users proceed with care. Attempts to open documents that include calculations developed through the old Equation Editor will prompt a pop-up that asks users whether they want to open the file in Protected View mode. Users should use this option until updates are applied.