Microsoft · Office
The flaw is an uninitialized memory use vulnerability in Microsoft Office 2013 SP1 and 2013 RT SP1, in how the Office software handles memory. An attacker can execute arbitrary code by sending a crafted Office document over the network, and the attack requires a user to open that document.
Microsoft Office 2013 SP1 and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Uninitialized Memory Use Vulnerability."
First seen exploited 3 years after disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
arbitrary code execution on victim
allows remote attackers to execute arbitrary code
user opens malicious document triggers exploit
via a crafted Office document
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2015-1770 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
The researchers describe the presumed existence of an exploit document ‘builder’ designed to selectively weaponize .rtf files using four older, patched, vulnerabilities: CVE-2012-0158, CVE-2012-1856, CVE-2015-1641, and CVE-2015-1770.
Mentions the CVE; no further detail.
2 passages name itOriginal (opens in a new tab) ↗
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.