CVE-2017-0199

CVE-2017-0199 is a software vulnerability that allows for remote code execution against older versions of Microsoft Office and Windows. This flaw in software design or implementation has been a popular vector of attack, with more than 5,600 malware samples exploiting the issue within a year, including 15 malicious samples reported from Egypt according to BlackBerry. Once a file containing this exploit is activated, it takes advantage of the bug and downloads the malware payload. Throughout its history, this vulnerability has been used in maldocs to spread numerous notorious malware families, such as Dridex in 2017 and Guloader in 2021. The exploit has also been incorporated quickly by APT34 to target organizations in the Middle East, among other instances. Despite not seeing much high-end activity involving Middle Eastern actors, there were two reports produced around the use of this zero-day exploit. To mitigate this threat, NSP customers have had new signatures added to the "HTTP: Microsoft Office OLE Arbitrary Code Execution Vulnerability (CVE-2017-0199)" attack name. However, the widespread usage and impact of this vulnerability underscore the importance of maintaining up-to-date software versions and implementing robust cybersecurity measures to prevent exploitation of such vulnerabilities.