Emerging Threat: Hacker Exploits in the Latest Microsoft Office Software Packages
Emerging Threat: Hacker Exploits in the Latest Microsoft Office Software Packages
Microsoft has disclosed a zero-day “max severity” vulnerability that impacts several Office and 356 products. Attackers may exploit this vulnerability to steal private data from individuals or organizations. A patch should be available on August 13th.
The flaw in question, nicknamed “Microsoft Office Spoofing Vulnerability” and tracked as CVE-2024-38200 , is relatively easy to exploit. An attacker doesn’t need to trick their victim into opening a malicious file or running a bad program. They simply need to guide the victim to a website that contains a “specially crafted file,” according to Microsoft.
The following products are impacted by CVE-2024-38200:
- Microsoft Office 2016 (32-bit & 64-bit)
- Microsoft Office 2016 (32-bit & 64-bit)
- Microsoft Office LTSC 2021 (32-bit & 64-bit)
- Microsoft 365 Apps for Enterprise (32-bit & 64-bit)
MITRE says that attackers are highly likely to exploit this vulnerability. For its part, Microsoft marks exploitability as “less likely,” meaning that a patch should be available before attackers can figure out how to build the malicious file needed for exploitation. (In any case, individuals or organizations who fail to install the needed security updates will be at risk of attack.)
Microsoft attributes the discovery of CVE-2024-38200 to PrivSec Consulting’s Jim Rush and Synack Red Team’s Metin Yunus Kandemir. Evidently, Rush plans to discuss this and other Microsoft Software vulnerabilities at DEF CON 2024 (which runs from August 8th to the 11th).
Individuals who utilize an affected version of Microsoft Office should, as always, avoid opening unknown websites (particularly those shared via email). Organizations may take more aggressive steps the mitigate their risk—Microsoft suggests adding sensitive users to the Protected Users Security Group. Blocking TCP 445/SMB outbound in firewall and VPN settings may also reduce potential exposure. Both of these changes can be reversed after installing Microsoft’s security patch, which is tentatively planned for August 13th.
Microsoft is currently working to patch several flaws across the Windows operating system and its first-party apps. One of these flaws, which could let an attacker “unpatch” a system and take advantage of outdated exploits, is particularly interesting and insidious.
Source: Microsoft via BleepingComputer
Also read:
- [New] Daily Digest Guidelines Tips for Successful Vlogs for 2024
- [Updated] 2024 Approved Methods for Making Meetings Memorable
- [Updated] From Still Screens to MP3 Beats - Insta Video Tips
- [Updated] The Ultimate Compilation of Devout Ringtones
- Boosting Skype's Performance with Advanced Zoom Functionalities
- How to Get and Use Pokemon Go Promo Codes On Xiaomi 14 Ultra | Dr.fone
- In 2024, How Can I Unlock My Apple iPhone X After Forgetting my PIN Code?
- In 2024, Top 30 Free Mac Speech-to-Text Software You've Missed
- Pioneering Portable VRs Google Cardboard Versus Samsung's Tech for 2024
- Top-Notch Drones for Professionals – Our Curated List for 2024
- Troubleshooting Tips - Easy Ways to Solve PS4 Random Crashes and Freezes
- Unveiling the Power of Azure Voice Recognition API for 2024
- Title: Emerging Threat: Hacker Exploits in the Latest Microsoft Office Software Packages
- Author: Daniel
- Created at : 2024-10-09 10:44:59
- Updated at : 2024-10-16 00:32:15
- Link: https://some-skills.techidaily.com/emerging-threat-hacker-exploits-in-the-latest-microsoft-office-software-packages/
- License: This work is licensed under CC BY-NC-SA 4.0.