The company Office 0patch had informed me by mail about the following: In Office 2003, the equation editor is not vulnerable. The speculation was that Microsoft no longer has access to the source code.Īnd there is another strange thing. In my German blog post Hat Microsoft Zugriff auf Teile des Office-Quellcodes verloren? I had also pointed out that Microsoft has patched the formula editor binary, which is a bit obscure. Microsoft had to take action because hackers already exploited this vulnerability (see Hacker are misusing CVE-2017-11882 in Office EQNEDT32.EXE). While Microsoft replaced the old EQNEDT32.EXE component with a new component in 2007, the older file is still included in all Office installations so that users can load and edit equations that were created with the old component. The equation editor EQNEDT32.EXE, which was included in Microsoft Office until 2007 but was still shipped with Office, received an update to close the gap on November 2017 patchday (I mentioned it in the blog post Microsoft Office security updates (November 14, 2017)). It turned out that this vulnerability was present in all Microsoft Office and Windows versions for the last 17 years.
An article about the bugs can also be found here.
In the summer of 2017, researchers from the cyber security company Embedi discovered a CVE-2017-11882 vulnerability in the Office formula editor. Equation Edition s a sad chapter in Microsoft Office.
0 kommentar(er)
