A mere days after the Sandworm bug was discovered, a new zero-day that affects almost all versions of Windows has been found traipsing through the cyber-wild.
Like Sandworm, it also makes use of the Object Linking and Embedding (OLE) feature, which is a technology that allows applications to share data and functionality, such as the ability to create and edit compound data.
The vulnerability could allow remote-code execution if a user opens a specially crafted Microsoft Office file that contains an OLE object. An attacker who successfully exploited the vulnerability could gain the same user rights as a legitimate user—so those whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with, say, administrative user rights.
In a web-based attack scenario, an attacker could host a website that contains a webpage with a specially crafted Office file that is used to attempt to exploit this vulnerability. According to Microsoft, there are “limited, targeted attacks” going around that attempt to exploit the vulnerability through Microsoft PowerPoint.
Social engineering is the way for the attacker to execute, convincing users to visit the website by getting them to click a link within an email or instant message.
“We are actively working with partners in our Microsoft Active Protections Program (MAPP) to provide information that they can use to provide broader protections to customers,” Microsoft said in an advisory. “Upon completion of this investigation, Microsoft will take the appropriate action to help protect our customers. This may include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs.”
There is one catch for the criminals: the attack requires user interaction beyond clicking an emailed link to succeed on Windows clients with a default configuration. User Account Control (UAC) is enabled in that case and will display a consent prompt or an elevation prompt, depending on the privileges of the current user, before a file containing the exploit is executed.
The news comes about a week after Microsoft patched a remote code execution zero day vulnerability linked to the Russian espionage group known as Sandworm. That bug was being used in spear-phishing attacks that used a weaponized PowerPoint attachment.