Attackers are using a zero day vulnerability in nearly all supported versions of Windows in a series of targeted attacks. The flaw is in the OLE technology in Windows and can be used for remote code execution is a targeted user opens a rigged Office file.
Microsoft is warning customers that there is no patch available for this new vulnerability. The company has issued a FixIt tool that mitigates the known attacks on the vulnerability, but is still looking into whether a full patch will be necessary.
“Microsoft is aware of a vulnerability affecting all supported releases of Microsoft Windows, excluding Windows Server 2003. The vulnerability could allow remote code execution if a user opens a specially crafted Microsoft Office file that contains an OLE object. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights. The attack requires user interaction to succeed on Windows clients with a default configuration, as User Account Control (UAC) is enabled and a consent prompt is displayed,” the Microsoft advisory says.
The attacks that have been seen so far are using malicious PowerPoint files to exploit the OLE vulnerability. This is the second bug in the OLE packager that’s surfaced in the last couple of weeks. On Oct. 14 researchers at iSIGHT Partners disclosed an ongoing series of attacks against a variety of targets, some of which involve the use of CVE-2014-4114, a similar flaw that affects OLE. The Sandworm team, an APT group, has been using that vulnerability in conjunction with others in order to compromise targets in government, energy and other industries.
Microsoft’s regular monthly patch release came just last week, so if the company decides to push a fix for this new OLE vulnerability, it would either comes as an out-of-band patch in the next couple of weeks or not until Nov. 11.
“Upon completion of this investigation, Microsoft will take the appropriate action to help protect our customers. This may include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs,” the company said.
In addition to the FixIt tool, Microsoft officials are suggesting that users deploy the EMET 5.0 toolkit and configure the Attack Surface Reduction option, which can mitigate the attacks on the flaw.
