Microsoft Office Apps Provide a New Path for Hackers

The flaw in question, nicknamed "Microsoft Office Spoofing Vulnerability" and tracked as CVE-2024-38200, is relatively easy to exploit. An attacker doesn't need to trick their victim into opening a malicious file or running a bad program. They simply need to guide the victim to a website that contains a "specially crafted file," according to Microsoft.

The following products are impacted by CVE-2024-38200:

• Microsoft Office 2016 (32-bit & 64-bit)
• Microsoft Office 2016 (32-bit & 64-bit)
• Microsoft Office LTSC 2021 (32-bit & 64-bit)
• Microsoft 365 Apps for Enterprise (32-bit & 64-bit)

  MITRE says that attackers are highly likely to exploit this vulnerability. For its part, Microsoft marks exploitability as "less likely," meaning that a patch should be available before attackers can figure out how to build the malicious file needed for exploitation. (In any case, individuals or organizations who fail to install the needed security updates will be at risk of attack.)

  Microsoft attributes the discovery of CVE-2024-38200 to PrivSec Consulting's Jim Rush and Synack Red Team's Metin Yunus Kandemir. Evidently, Rush plans to discuss this and other Microsoft Software vulnerabilities at DEF CON 2024 (which runs from August 8th to the 11th).

  Individuals who utilize an affected version of Microsoft Office should, as always, avoid opening unknown websites (particularly those shared via email). Organizations may take more aggressive steps the mitigate their risk—Microsoft suggests adding sensitive users to the Protected Users Security Group. Blocking TCP 445/SMB outbound in firewall and VPN settings may also reduce potential exposure. Both of these changes can be reversed after installing Microsoft's security patch, which is tentatively planned for August 13th.

  Microsoft is currently working to patch several flaws across the Windows operating system and its first-party apps. One of these flaws, which could let an attacker "unpatch" a system and take advantage of outdated exploits, is particularly interesting and insidious.

  Source: Microsoft via BleepingComputer

  Your changes have been saved

  Email is sent

  Email has already been sent

  Please verify your email address.

  Send confirmation email

  You’ve reached your account maximum for followed topics.

The above is the detailed content of Microsoft Office Apps Provide a New Path for Hackers. For more information, please follow other related articles on the PHP Chinese website!