7.8
CVSSv3

CVE-2018-0802

Published: 10/01/2018 Updated: 24/08/2020
CVSS v2 Base Score: 9.3 | Impact Score: 10 | Exploitability Score: 8.6
CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8
VMScore: 832
Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Vulnerability Summary

Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE is unique from CVE-2018-0797 and CVE-2018-0812.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

microsoft office 2007

microsoft office 2013

microsoft word 2013

microsoft office 2016

microsoft office compatibility pack -

microsoft word 2007

microsoft word 2010

microsoft office 2010

microsoft word 2016

Github Repositories

RTF_11882_0802 CVE-2017-11882 CVE-2017-11882: portalmsrcmicrosoftcom/en-US/security-guidance/advisory/CVE-2017-11882 MITRE CVE-2017-11882: cvemitreorg/cgi-bin/cvenamecgi?name=CVE-2017-11882 Research: embedicom/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about Patch analysis: 0patchblogspotru/2017/11/did-microsoft-just-man

CVE-2018-0802 CVE-2018-08022: portalmsrcmicrosoftcom/en-US/security-guidance/advisory/CVE-2018-0802 MITRE CVE-2018-0802: cvemitreorg/cgi-bin/cvenamecgi?name=CVE-2018-0802 0patch exploitation and patch video: wwwyoutubecom/watch?v=XU-U4K270Z4 Qihoo 360 blog post wwwfreebufcom/vuls/159789html Checkpoint blog (brute-force ASLR by

PoC Exploit for CVE-2018-0802 (and optionally CVE-2017-11882)

CVE-2018-0802 CVE-2018-08022: portalmsrcmicrosoftcom/en-US/security-guidance/advisory/CVE-2018-0802 MITRE CVE-2018-0802: cvemitreorg/cgi-bin/cvenamecgi?name=CVE-2018-0802 0patch exploitation and patch video: wwwyoutubecom/watch?v=XU-U4K270Z4 Qihoo 360 blog post wwwfreebufcom/vuls/159789html Checkpoint blog (brute-force ASLR by

Exploit the vulnerability to execute the calculator

CVE-2018-0802_POC usage: cve-2018-0802_pocpy [-h] -e EXECUTABLE -o OUTPUT The rtf sample exploit the vulnerability to execute the calculator

PoC for CVE-2018-0802 And CVE-2017-11882

RTF_11882_0802 CVE-2017-11882 CVE-2017-11882: portalmsrcmicrosoftcom/en-US/security-guidance/advisory/CVE-2017-11882 MITRE CVE-2017-11882: cvemitreorg/cgi-bin/cvenamecgi?name=CVE-2017-11882 Research: embedicom/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about Patch analysis: 0patchblogspotru/2017/11/did-microsoft-just-man

Extract OLEv1 objects from RTF files by instrumenting Word

Introduction rtfraptor is a simple tool to aid analysis of malicious RTF files by extracting OLEv1 objects It was inspired by a blog post by Denis O'Brien (link below) It works by running Word and intercepting calls to OLEv1 functions This allows raw OLE objects to be dumped from memory for further analysis The tool is designed to be run on Windows This is useful f

RTF_11882_0802 CVE-2017-11882 CVE-2017-11882: portalmsrcmicrosoftcom/en-US/security-guidance/advisory/CVE-2017-11882 MITRE CVE-2017-11882: cvemitreorg/cgi-bin/cvenamecgi?name=CVE-2017-11882 Research: embedicom/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about Patch analysis: 0patchblogspotru/2017/11/did-microsoft-just-man

RTF_11882_0802 CVE-2017-11882 CVE-2017-11882: portalmsrcmicrosoftcom/en-US/security-guidance/advisory/CVE-2017-11882 MITRE CVE-2017-11882: cvemitreorg/cgi-bin/cvenamecgi?name=CVE-2017-11882 Research: embedicom/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about Patch analysis: 0patchblogspotru/2017/11/did-microsoft-just-man

Malware-analysis-REMnux Overview This document provides a detailed walkthrough of the process for analyzing a real malware file using REMnux, a Linux distribution focused on assisting malware analysts with reverse-engineering tasks The document, a demonstration of MyDFIR, guides the reader through steps such as downloading the malware file, extracting its contents, examining

document-eqnobj-dataset This dataset is used to train CNN model to detect malicious document with formula editors exploits, such as CVE-2017-11882, CVE-2018-0802 and CVE-2018-0798 01-train_oleEqnB 4078 benign Equation Ole Objects comes from Internet and my lab 02-train_oleEqnM 1173 malicious Equation Ole Objects comes from 1798 malicious RTF files in Virustotal 03-test_oleEqn

Pada bulan maret 2023, terdapat sample baru yang terindentifikasi sebagai malware. Malware tersebut berasal dari file berekstensi.xls dan .doc dan dikenal dengan nama “Bank Slip.xls”. Aktivitas malware tersebut memiliki hubungan dengan kerentanan yang dikenal dengan id CVE-2017-11882 dan CVE-2018-0802.

Maldoc-Analysis Pada bulan maret 2023, terdapat sample baru yang terindentifikasi sebagai malware Malware tersebut berasal dari file berekstensixls dan doc dan dikenal dengan nama “Bank Slipxls” Aktivitas malware tersebut memiliki hubungan dengan kerentanan yang dikenal dengan id CVE-2017-11882 dan CVE-2018-0802

CVE-2017-11882 Study Student Name: Peiran Sun, Yufeng Ge Date:2022220 Intro: Today we are going to talk about a vulnerability that affects everyone who uses Microsoft office for almost two decades When you opened a Microsoft Office file, have you ever noticed this annoying warning? I always wonder, how can a file display only text and pictures, maybe sometimes video, harmin

Malware-analysis-REMnux Overview This document provides a detailed walkthrough of the process for analyzing a real malware file using REMnux, a Linux distribution focused on assisting malware analysts with reverse-engineering tasks The document, a demonstration of MyDFIR, guides the reader through steps such as downloading the malware file, extracting its contents, examining

Recent Articles

Spam and phishing in 2023
Securelist • Tatyana Kulikova • 07 Mar 2024

The year in figures 45.60% of all email sent worldwide and 46.59% of all email sent in the Runet (the Russian web segment) was spam 31.45% of all spam email was sent from Russia Kaspersky Mail Anti-Virus blocked 135,980,457 malicious email attachments Our Anti-Phishing system thwarted 709,590,011 attempts to follow phishing links SafeMessaging feature in Kaspersky mobile solutions prevented more than 62,000 redirects via phishing links from Telegram Phishing and scams in 2023 Hunting gamers In 2...

IT threat evolution in Q3 2023. Non-mobile statistics
Securelist • AMR • 01 Dec 2023

These statistics are based on detection verdicts of Kaspersky products and services received from users who consented to providing statistical data. Quarterly figures According to Kaspersky Security Network, in Q3 2023: Kaspersky solutions blocked 694,400,301 attacks from online resources across the globe. A total of 169,194,807 unique links were recognized as malicious by Web Anti-Virus components. Attempts to run malware for stealing money from online bank accounts were stopped on the com...

IT threat evolution in Q2 2023. Non-mobile statistics
Securelist • AMR • 30 Aug 2023

IT threat evolution in Q2 2023 IT threat evolution in Q2 2023. Non-mobile statistics IT threat evolution in Q2 2023. Mobile statistics These statistics are based on detection verdicts of Kaspersky products and services received from users who consented to providing statistical data. Quarterly figures According to Kaspersky Security Network, in Q2 2023: Kaspersky solutions blocked 801,934,281 attacks from online resources across the globe. A total of 209,716,810 unique links were detected by Web ...

IT threat evolution in Q1 2023. Non-mobile statistics
Securelist • AMR • 07 Jun 2023

IT threat evolution in Q1 2023 IT threat evolution in Q1 2023. Non-mobile statistics IT threat evolution in Q1 2023. Mobile statistics These statistics are based on detection verdicts of Kaspersky products and services received from users who consented to providing statistical data. Quarterly figures According to Kaspersky Security Network, in Q1 2023: Kaspersky solutions blocked 865,071,227 attacks launched from online resources across the globe. Web Anti-Virus detected 246,912,694 unique URLs ...

Spam and phishing in 2022
Securelist • Tatyana Kulikova • 16 Feb 2023

Figures of the year In 2022: 48.63% of all emails around the world and 52.78% of all emails in the Russian segment of the internet were spam As much as 29.82% of all spam emails originated in Russia Kaspersky Mail Anti-Virus blocked 166,187,118 malicious email attachments Our Anti-Phishing system thwarted 507,851,735 attempts to follow phishing links 378,496 attempts to follow phishing links were associated with Telegram account hijacking Phishing in 2022 Last year’s resonant global events The...

IT threat evolution in Q3 2022. Non-mobile statistics
Securelist • AMR • 18 Nov 2022

IT threat evolution in Q3 2022 IT threat evolution in Q3 2022. Non-mobile statistics IT threat evolution in Q3 2022. Mobile statistics These statistics are based on detection verdicts of Kaspersky products and services received from users who consented to providing statistical data. Quarterly figures According to Kaspersky Security Network, in Q3 2022: Kaspersky solutions blocked 956,074,958 attacks from online resources across the globe. Web Anti-Virus recognized 251,288,987...

IT threat evolution in Q2 2022. Non-mobile statistics
Securelist • AMR • 15 Aug 2022

IT threat evolution in Q2 2022 IT threat evolution in Q2 2022. Non-mobile statistics IT threat evolution in Q2 2022. Mobile statistics These statistics are based on detection verdicts of Kaspersky products and services received from users who consented to providing statistical data. Quarterly figures According to Kaspersky Security Network, in Q2 2022: Kaspersky solutions blocked 1,164,544,060 attacks from online resources across the globe. Web Anti-Virus recognized 273,033,368 unique URLs as ma...

IT threat evolution in Q1 2022. Non-mobile statistics
Securelist • AMR • 27 May 2022

IT threat evolution in Q1 2022 IT threat evolution in Q1 2022. Non-mobile statistics IT threat evolution in Q1 2022. Mobile statistics These statistics are based on detection verdicts of Kaspersky products and services received from users who consented to providing statistical data. Quarterly figures According to Kaspersky Security Network, in Q1 2022: Kaspersky solutions blocked 1,216,350,437 attacks from online resources across the globe. Web Anti-Virus recognized 313,164,030 unique URLs as ma...

Spam and phishing in 2021
Securelist • Tatyana Kulikova • 09 Feb 2022

Figures of the year In 2021: 56% of e-mails were spam 77% of spam was sent from Russia with another 14.12% from Germany Our Mail Anti-Virus blocked 148 173 261 malicious attachments sent in e-mails The most common malware family found in attachments were Agensla Trojans Our Anti-Phishing system blocked 253 365 212 phishing links Safe Messaging blocked 341 954 attempts to follow phishing links in messengers Trends of the year How to make an unprofitable investment with no...

IT threat evolution Q3 2020. Non-mobile statistics
Securelist • Victor Chebyshev Fedor Sinitsyn Denis Parinov Oleg Kupreev Evgeny Lopatin Alexey Kulaev Alexander Kolesnikov • 20 Nov 2020

These statistics are based on detection verdicts of Kaspersky products received from users who consented to provide statistical data. According to Kaspersky Security Network, in Q3: In Q3 2020, Kaspersky solutions blocked attempts to launch one or more types of malware designed to steal money from bank accounts on the computers of 146,761 users. !function(e,i,n,s){var t="InfogramEmbeds",d=e.getElementsByTagName("script")[0];if(window[t]&&window[t].initialized)window[t].process&&w...

IT threat evolution Q2 2020. PC statistics
Securelist • Victor Chebyshev Evgeny Lopatin Fedor Sinitsyn Denis Parinov Oleg Kupreev Alexey Kulaev Alexander Kolesnikov • 03 Sep 2020

IT threat evolution Q2 2020. Review IT threat evolution Q2 2020. Mobile statistics These statistics are based on detection verdicts of Kaspersky products received from users who consented to provide statistical data. According to Kaspersky Security Network, in Q2: In Q2 2020, Kaspersky solutions blocked attempts to launch one or more types of malware designed to steal money from bank accounts on the computers of 181,725 users. !function(e,i,n,s){var t="InfogramEmbeds",d=e.getElementsByTagName("s...

Cycldek: Bridging the (air) gap
Securelist • GReAT Mark Lechtik Giampaolo Dedola • 03 Jun 2020

While investigating attacks related to a group named Cycldek post 2018, we were able to uncover various pieces of information on its activities that were not known thus far. In this blog post we aim to bridge the knowledge gap on this group and provide a more thorough insight into its latest activities and modus operandi. Here are some key insights that will be described in this publication: Cycldek is a long-known Chinese-speaking threat actor. Based on the group’s past activity, it has a str...

IT threat evolution Q1 2020. Statistics
Securelist • Victor Chebyshev Fedor Sinitsyn Denis Parinov Oleg Kupreev Evgeny Lopatin Alexey Kulaev • 20 May 2020

These statistics are based on detection verdicts for Kaspersky products received from users who consented to providing statistical data. According to Kaspersky Security Network, Q1 2020 will be remembered primarily for the coronavirus pandemic and cybercriminals’ exploitation of the topic. In particular, the creators of a new modification of the Ginp banking trojan renamed their malware Coronavirus Finder and then began offering it for €0.75 disguised as an app supposedly capable of detectin...

IT threat evolution Q3 2019. Statistics
Securelist • Victor Chebyshev Fedor Sinitsyn Denis Parinov Boris Larin Oleg Kupreev Evgeny Lopatin • 29 Nov 2019

These statistics are based on detection verdicts of Kaspersky products received from users who consented to provide statistical data. According to Kaspersky Security Network: In Q3 2019, we discovered an extremely unpleasant incident with the popular CamScanner app on Google Play. The new version of the app contained an ad library inside with the Trojan dropper Necro built in. Judging by the reviews on Google Play, the dropper’s task was to activate paid subscriptions, although it could delive...

IT threat evolution Q3 2019
Securelist • David Emm • 29 Nov 2019

At the end of June we reported the details of a highly targeted campaign that we dubbed ‘Operation ViceLeaker’ involving the spread of malicious Android samples via instant messaging. The campaign affected several dozen victims in Israel and Iran. We discovered this activity in May 2018, right after Israeli security agencies announced that Hamas had installed spyware on the smartphones of Israeli soldiers, and we released a private report on our Threat Intelligence Portal. We believe the mal...

IT threat evolution Q2 2019. Statistics
Securelist • Victor Chebyshev Fedor Sinitsyn Denis Parinov Boris Larin Oleg Kupreev Evgeny Lopatin • 19 Aug 2019

These statistics are based on detection verdicts of Kaspersky products received from users who consented to provide statistical data. According to Kaspersky Security Network, Q2 2019 will be remembered for several events. First, we uncovered a large-scale financial threat by the name of Riltok, which targeted clients of not only major Russian banks, but some foreign ones too. Second, we detected the new Trojan.AndroidOS.MobOk malware, tasked with stealing money from mobile accounts through explo...

Recent Cloud Atlas activity
Securelist • GReAT • 12 Aug 2019

Also known as Inception, Cloud Atlas is an actor that has a long history of cyber-espionage operations targeting industries and governmental entities. We first reported Cloud Atlas in 2014 and we’ve been following its activities ever since. From the beginning of 2019 until July, we have been able to identify different spear-phishing campaigns related to this threat actor mostly focused on Russia, Central Asia and independent regions of Ukraine. Cloud Atlas hasn’t changed its TTPs (Tactic Too...

IT threat evolution Q1 2019. Statistics
Securelist • Victor Chebyshev Fedor Sinitsyn Denis Parinov Boris Larin Oleg Kupreev Evgeny Lopatin • 23 May 2019

These statistics are based on detection verdicts of Kaspersky Lab products received from users who consented to provide statistical data. According to Kaspersky Security Network, Q1 2019 is remembered mainly for mobile financial threats. First, the operators of the Russia-targeting Asacub Trojan made several large-scale distribution attempts, reaching up to 13,000 unique users per day. The attacks used active bots to send malicious links to contacts in already infected smartphones. The mailings ...

Spam and phishing in Q1 2019
Securelist • Maria Vergelis Tatyana Shcherbakova Tatyana Sidorina • 15 May 2019

As per tradition, phishing timed to coincide with lovey-dovey day was aimed at swindling valuable confidential information out of starry-eyed users, such as bank card details. The topics exploited by cybercriminals ranged from online flower shops to dating sites. But most often, users were invited to order gifts for loved ones and buy medications such as Viagra. Clicking/tapping the link in such messages resulted in the victim’s payment details being sent to the cybercriminals. Late March saw ...

Kaspersky updates its cybercrook look book: Smashing Office is hot, browser vulns are not
The Register • Gareth Corfield • 16 Apr 2019

Over two-thirds of attacks Russian biz spied targeted venerable Microsoft suite If at first you, er, make things worse, you're probably Microsoft: Bug patch needed patching

Russian security biz Kaspersky Lab has said more than 70 per cent of malware attacks it detected last year were made against everyone's favourite Microsoft suite – Office. "In the past few months, MS Office... became the most targeted platform," the firm said in a blog post. It produced a graph showing that between Q4 2016 and Q4 2018, Office-targeting attacks rose from 16 per cent of total Kaspersky detections to more than two-thirds. The outfit also reported a switch away from ne'er-do-wells...

IT threat evolution Q3 2018. Statistics
Securelist • Victor Chebyshev Fedor Sinitsyn Denis Parinov Oleg Kupreev Evgeny Lopatin Alexander Liskin • 12 Nov 2018

These statistics are based on detection verdicts of Kaspersky Lab products received from users who consented to provide statistical data. According to Kaspersky Security Network: Perhaps the biggest news of the reporting period was the Trojan-Banker.AndroidOS.Asacub epidemic. It peaked in September when more than 250,000 unique users were attacked – and that only includes statistics for those with Kaspersky Lab’s mobile products installed on their devices. Number of users attacked by the mob...

IT threat evolution Q1 2018. Statistics
Securelist • Victor Chebyshev Fedor Sinitsyn Denis Parinov Alexander Liskin Oleg Kupreev • 14 May 2018

According to KSN: In Q1 2018, DNS-hijacking, a new in-the-wild method for spreading mobile malware on Android devices, was identified. As a result of hacked routers and modified DNS settings, users were redirected to IP addresses belonging to the cybercriminals, where they were prompted to download malware disguised, for example, as browser updates. That is how the Korean banking Trojan Wroba was distributed. It wasn’t a drive-by-download case, since the success of the attack largely depended ...

Don't just grab your CPU bug updates – there's a nasty hole in Office, too
The Register • Shaun Nichols in San Francisco • 09 Jan 2018

It's 2018 and a Word doc can still pwn your Windows computer

Patch Tuesday In case you've been hiding under a rock for the entirety of this new year (and we don't blame you if you have) there are a handful of major security flaws that have been dominating the news, and feature prominently in this month's Patch Tuesday update load. First, let's look at the latest developments in the Meltdown/Spectre saga: Nvidia has got around to kicking out graphics driver updates that address the Spectre flaws present in its code – for example, here are some patches fo...