Microsoft · Office
The Equation Editor component in Microsoft Office 2007, 2010, 2013, and 2016 contains a memory corruption flaw caused by how it handles objects in memory, classified as an out-of-bounds write. An attacker can achieve remote code execution over the network without authentication, but only if a user is induced to interact with a crafted file or document.
Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Office Memory Corruption Vulnerability".
First seen exploited 11 months after disclosure. Public exploit code (PoC-in-GitHub) appeared 5 years after disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
x MITRE ATT&CK Techniques Tactic Technique ID Description Initial Access Spearphishing Attachment T1193 Used to deliver first stage malware Supply Chain Compromise T1195 Used for initial intrusion on subsidiaries Execution Exploitation for Client Execution T1203 Used to exploit CVE-2018-0802 and CVE- 2018-0798
During the last years, this OLE objects have been a good indicator that a document may aim to exploit the CVE-2018-0798 vulnerability in order to infect with some kind of malware.
User opens malicious document triggers exploitation
Equation Editor in Microsoft Office 2007, Microsoft Office 2010
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2018-0798 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
…the Equation Editor application is automatically launched to run the embedded objects containing the shellcode to exploit known vulnerabilities described by CVE-2017-11882, CVE-2018-0798 and CVE-2018-0802 — all in Microsoft Office — then downloads the trojan from the hosting server and runs it on the victim's…
2 passages name itOriginal (opens in a new tab) ↗
The infected spreadsheet delivers the threat through vulnerability described under CVE-2017-11882 and CVE-2018-0798.
During the last years, this OLE objects have been a good indicator that a document may aim to exploit the CVE-2018-0798 vulnerability in order to infect with some kind of malware.
RoyalRoad leverages a specific set of vulnerabilities, including CVE-2018-0802, CVE-2018-0798, and CVE-2017-11882, within the Equation Editor of Microsoft Office.
…x MITRE ATT&CK Techniques Tactic Technique ID Description Initial Access Spearphishing Attachment T1193 Used to deliver first stage malware Supply Chain Compromise T1195 Used for initial intrusion on subsidiaries Execution Exploitation for Client Execution T1203 Used to exploit CVE-2018-0802 and CVE- 2018-0798…
3 passages name itOriginal (opens in a new tab) ↗
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.