What simply occurred? A extreme Microsoft Office vulnerability has allowed attackers to execute code on course programs that bypass most safety measures for not less than a month. Researchers say this week’s Patch Tuesday has neutralized the vulnerability that state-backed hackers had exploited.
Testing carried out by Sophos confirms that Tuesday’s KB5014699 Windows replace neutralizes the Follina exploit, which allowed malicious Microsoft Word recordsdata to execute Powershell instructions on course programs. The exploit affected Office 2013, 2016, 2019, 2021, and a few variations of Microsoft 365 on Windows 10 and 11.
Follina labored by means of Microsoft Diagnostic Tool to retrieve an HTML file from a distant internet server after which used ms-msdt MSProtocol Uniform Resource Identifier to run Powershell code. It was notably harmful as a result of Windows Defender did not shield towards it, and it did not want elevated privileges or Office macros to work. Even Office’s Protected Mode — designed to cease malicious code embedded in paperwork — could not cease Follina. Users may set off it by merely opening a compromised doc in Windows Explorer’s preview pane.
We examined on Windows 11 (KB5014697) and Windows 10 (KB5014699). No replace -> calc popped / set up replace -> troubleshooter errored out / rollback -> moar calc. But nonetheless not listed as a safety repair within the June 2022 safety bulletin…
— Naked Security (@NakedSecurity) June 15, 2022
Chinese hackers used the exploit towards members of the Tibetan diaspora. Another assault in May targeted customers in Belarus. Earlier this month, Proofpoint blocked a Follina assault focusing on European Union and US native governments, which it suspects got here from a state actor.
Researchers alerted Microsoft of Follina in April however initially, it did not think about the exploit a essential safety risk — tracked as CVE-2022-30190. The KB5014699 replace’s patch notes do not point out Follina, however Sophos stories that additional exams point out the bug not works after putting in the replace.
