vulnwire
7.8high

CVE-2017-0199KEV · ransomwarein critical feed3 exploits

Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Window…

Published 9 y ago · modified 4 mo ago · JSON

CVSS
7.8
v3.1 · CNA
CISA KEV
Yes
added 2021-11-03
EPSS
99.5%
percentile 100%
Public exploits
3
Exploit-DB

Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API."

Known exploited (CISA KEV)

Added
5 y ago
Due date
2022-05-03 (4 y ago)
Ransomware use
Known to be used in ransomware campaigns
Required action
Apply updates per vendor instructions.
Vendor / product
Microsoft / Office and WordPad
CISA name
Microsoft Office and WordPad Remote Code Execution Vulnerability

CISA SSVC assessment

Exploitation
Active — exploited in the wild
Automatable
no
Technical impact
total
Assessed
20 mo ago

Exploit prediction (EPSS)

99.50% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

Exploits and detections

  • EDB-42995 Microsoft Excel - OLE Arbitrary Code Execution · dos · 2017-09-30
  • EDB-41934 Microsoft Office Word - '.RTF' Malicious HTA Execution (Metasploit) · remote · 2017-04-25
  • EDB-41894 Microsoft Word - '.RTF' Remote Code Execution · remote · 2017-04-18

CVSS scores

Assigned byVersionScoreVector
CISA ADP3.17.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD3.17.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA3.17.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD2.09.3AV:N/AC:M/Au:N/C:C/I:C/A:C

Affected products

  • Microsoft Corporation Office/WordPad

References

  • securityfocus.com /bid/97498 · vdb-entry, x_refsource_BID, x_transferred
  • blog.nviso.be /2017/04/12/analysis-of-a-cve-2017-0199-malicious-rtf-document/ · x_refsource_MISC, x_transferred
  • rewtin.blogspot.nl /2017/04/cve-2017-0199-practical-exploitation-poc.html · x_refsource_MISC, x_transferred
  • exploit-db.com /exploits/41894/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • fireeye.com /blog/threat-research/2017/04/cve-2017-0199_useda.html · x_refsource_MISC, x_transferred
  • portal.msrc.microsoft.com /en-US/security-guidance/advisory/CVE-2017-0199 · x_refsource_CONFIRM, x_transferred
  • ics-cert.us-cert.gov /advisories/ICSMA-18-058-02 · x_refsource_MISC, x_transferred
  • mdsec.co.uk /2017/04/exploiting-cve-2017-0199-hta-handler-vulnerability/ · x_refsource_MISC, x_transferred
  • exploit-db.com /exploits/41934/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • exploit-db.com /exploits/42995/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • securitytracker.com /id/1038224 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-0199 · government-resource

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.