Microsoft has released security patches to deal with a 17-year-old flaw that could be exploited to remotely initiate malicious code on all Windows versions.

According to Business Insider, researchers at Embedi discovered the flaw in the Microsoft Equation Editor and describe it as “extremely dangerous.” The vulnerability, which tracked as CVE-2017-11882, was patched in the recent November 2017 Patch Tuesday updates, Bleeping Computer reported. Until the security patches are implemented, IT decision-makers should take additional measures, including monitoring user behavior and turning off potentially exploitable components.

Understanding the Vulnerability

The Microsoft Equation Editor is installed by default on computers that run the Office suite. This tool gives users the ability to insert mathematical equations as Object Linking and Embedding (OLE) items in Microsoft Word documents.

Embedi researchers discovered that the Equation Editor was running an outdated code compiled in November 2000. Although Microsoft replaced in Office 2007 with an updated version, the previous form of Equation Editor remained in newer versions of Office to ensure that users could open documents with calculations created in older versions of the suite, Bleeping Computer noted.

The Equation Editor is unsafe because it runs outside Office and does not use of any of the recent Microsoft security features, such as Control Flow Guard, Threatpost noted. The Embedi researchers found that they could exploit the vulnerability by inserting OLEs into documents and then executing potentially harmful commands remotely.

Discovering the Bug

Researchers discovered the flaw using Microsoft’s BinScope tool, the company’s binary verification mechanism that confirms that files are built in compliance with the Microsoft Security Development Lifecycle requirements.

BinScope allowed Embedi to discover some of the most obsolete elements of Microsoft Office 2016, reported ZDNet. Other Windows components that have not been updated and have transferred between platforms could also be vulnerable to attacks.

The exploit worked across 32-bit and 64-bit architecture types, did not disturb the user’s Microsoft Office workflow and did not require any user interaction.

Security Patches Offer a Fix

To address the Equation Editor flaw, IT managers should download the security patches released by Microsoft. The November 2017 Patch Tuesday updates include includes fixes for 53 security bugs, according to another Bleeping Computer article.

Technology decision-makers should also ensure that users proceed with care. Attempts to open documents that include calculations developed through the old Equation Editor will prompt a pop-up that asks users whether they want to open the file in Protected View mode. Users should use this option until updates are applied.

More from

Hackers are Increasingly Targeting Auto Dealers

Auto dealerships are increasingly concerned with cybersecurity in the face of new regulations and an alarming rise in cyberattacks. The Second Annual Global State of Cybersecurity Report by CDK Global found that 85% of dealerships say cybersecurity is very or extremely important relative to other operational areas. Additionally, 89% say cybersecurity is more important than last year, a 12% increase. Not surprisingly, only 37% of auto retailers are confident in the current protection, which is a 21% decrease from 2021.…

Container Drift: Where Age isn’t Just a Number

Container orchestration frameworks like Kubernetes have brought about untold technological advances over the past decade. However, they have also enabled new attack vectors for bad actors to leverage. Before safely deploying an application, you must answer the following questions: How long should a container live? Does the container need to write any files during runtime? Determining the container’s lifetime and the context in which it runs is critical, especially when hosting an internet-facing service. What is Container Drift? When deploying…

Patch Tuesday -> Exploit Wednesday: Pwning Windows Ancillary Function Driver for WinSock (afd.sys) in 24 Hours

‘Patch Tuesday, Exploit Wednesday’ is an old hacker adage that refers to the weaponization of vulnerabilities the day after monthly security patches become publicly available. As security improves and exploit mitigations become more sophisticated, the amount of research and development required to craft a weaponized exploit has increased. This is especially relevant for memory corruption vulnerabilities.Figure 1 — Exploitation timelineHowever, with the addition of new features (and memory-unsafe C code) in the Windows 11 kernel, ripe new attack surfaces can…

OneNote, Many Problems? The New Phishing Framework

There are plenty of phish in the digital sea, and attackers are constantly looking for new bait that helps them bypass security perimeters and land in user inboxes. Their newest hook? OneNote documents. First noticed in December 2022, this phishing framework has seen success in fooling multiple antivirus (AV) tools by using .one file extensions, and January 2023 saw an attack uptick as compromises continued. While this novel notes approach will eventually be phased out as phishing defenses catch up,…